Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (363351 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-26198 1 Notable 1 Notable 2024-11-21 9.8 Critical
Notable v1.8.4 does not filter text editing, allowing attackers to execute arbitrary code via a crafted payload injected into the Title text field.
CVE-2022-26197 1 Joget 1 Joget Dx 2024-11-21 5.4 Medium
Joget DX 7 was discovered to contain a cross-site scripting (XSS) vulnerability via the Datalist table.
CVE-2022-26189 1 Totolink 2 N600r, N600r Firmware 2024-11-21 9.8 Critical
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface.
CVE-2022-26188 1 Totolink 2 N600r, N600r Firmware 2024-11-21 9.8 Critical
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost.
CVE-2022-26187 1 Totolink 2 N600r, N600r Firmware 2024-11-21 9.8 Critical
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function.
CVE-2022-26186 1 Totolink 2 N600r, N600r Firmware 2024-11-21 9.8 Critical
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi.
CVE-2022-26184 2 Microsoft, Python-poetry 2 Windows, Poetry 2024-11-21 9.8 Critical
Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
CVE-2022-26183 2 Microsoft, Pnpm 2 Windows, Pnpm 2024-11-21 8.8 High
PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.
CVE-2022-26181 1 Dropbox 1 Lepton 2024-11-21 7.8 High
Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():src/lepton/bitops.cc:108.
CVE-2022-26180 1 Qdpm 1 Qdpm 2024-11-21 8.8 High
qdPM 9.2 allows Cross-Site Request Forgery (CSRF) via the index.php/myAccount/update URI.
CVE-2022-26174 1 Beekeeperstudio 1 Beekeeper-studio 2024-11-21 9.8 Critical
A remote code execution (RCE) vulnerability in Beekeeper Studio v3.2.0 allows attackers to execute arbitrary code via a crafted payload injected into the display fields.
CVE-2022-26173 1 Jforum 1 Jforum 2024-11-21 8.8 High
JForum v2.8.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via http://target_host:port/jforum-2.8.0/jforum.page, which allows attackers to arbitrarily add admin accounts.
CVE-2022-26171 1 Bank Management System Project 1 Bank Management System 2024-11-21 9.8 Critical
Bank Management System v1.o was discovered to contain a SQL injection vulnerability via the email parameter.
CVE-2022-26170 1 Simple Mobile Comparison Website Project 1 Simple Mobile Comparison Website 2024-11-21 9.8 Critical
Simple Mobile Comparison Website v1.0 was discovered to contain a SQL injection vulnerability via the search parameter.
CVE-2022-26169 1 Air Cargo Management System Project 1 Air Cargo Management System 2024-11-21 9.8 Critical
Air Cargo Management System v1.0 was discovered to contain a SQL injection vulnerability via the ref_code parameter.
CVE-2022-26159 1 Ametys 1 Ametys 2024-11-21 5.3 Medium
The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/<domain>/en.xml (and similar pathnames for other languages), which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords.
CVE-2022-26158 1 Cherwell 1 Cherwell Service Management 2024-11-21 6.1 Medium
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It accepts and reflects arbitrary domains supplied via a client-controlled Host header. Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attacker-controlled page.
CVE-2022-26157 1 Cherwell 1 Cherwell Service Management 2024-11-21 5.3 Medium
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie is not protected by the Secure flag. This makes it prone to interception by an attacker if traffic is sent over unencrypted channels.
CVE-2022-26156 1 Cherwell 1 Cherwell Service Management 2024-11-21 6.1 Medium
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. Injection of a malicious payload within the RelayState= parameter of the HTTP request body results in the hijacking of the form action. Form-action hijacking vulnerabilities arise when an application places user-supplied input into the action URL of an HTML form. An attacker can use this vulnerability to construct a URL that, if visited by another application user, will modify the action URL of a form to point to the attacker's server.
CVE-2022-26155 1 Cherwell 1 Cherwell Service Management 2024-11-21 6.1 Medium
An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. XSS can occur via a payload in the SAMLResponse parameter of the HTTP request body.