Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (324458 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-12333 2 Code-projects, Fabian 2 E-commerce Website, E-commerce Website 2025-10-30 4.3 Medium
A vulnerability has been found in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/supplier_add.php. The manipulation of the argument supp_name/supp_address leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2022-22963 3 Oracle, Redhat, Vmware 29 Banking Branch, Banking Cash Management, Banking Corporate Lending Process Management and 26 more 2025-10-30 9.8 Critical
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
CVE-2022-22965 6 Cisco, Oracle, Redhat and 3 more 45 Cx Cloud Agent, Commerce Platform, Communications Cloud Native Core Automated Test Suite and 42 more 2025-10-30 9.8 Critical
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2021-1647 1 Microsoft 20 Security Essentials, System Center Endpoint Protection, Windows 10 1507 and 17 more 2025-10-30 7.8 High
Microsoft Defender Remote Code Execution Vulnerability
CVE-2021-1675 1 Microsoft 21 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 18 more 2025-10-30 7.8 High
Windows Print Spooler Remote Code Execution Vulnerability
CVE-2021-1732 1 Microsoft 11 Windows 10 1803, Windows 10 1809, Windows 10 1909 and 8 more 2025-10-30 7.8 High
Windows Win32k Elevation of Privilege Vulnerability
CVE-2021-26411 1 Microsoft 16 Edge, Internet Explorer, Windows 10 1507 and 13 more 2025-10-30 8.8 High
Internet Explorer Memory Corruption Vulnerability
CVE-2021-26855 1 Microsoft 1 Exchange Server 2025-10-30 9.1 Critical
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26857 1 Microsoft 1 Exchange Server 2025-10-30 7.8 High
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26858 1 Microsoft 1 Exchange Server 2025-10-30 7.8 High
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-27059 1 Microsoft 2 Excel, Office 2025-10-30 7.6 High
Microsoft Office Remote Code Execution Vulnerability
CVE-2021-27065 1 Microsoft 1 Exchange Server 2025-10-30 7.8 High
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-27085 1 Microsoft 7 Internet Explorer, Windows 10 1803, Windows 10 1809 and 4 more 2025-10-30 8.8 High
Internet Explorer Remote Code Execution Vulnerability
CVE-2021-28310 1 Microsoft 11 Windows 10 1803, Windows 10 1809, Windows 10 1909 and 8 more 2025-10-30 7.8 High
Win32k Elevation of Privilege Vulnerability
CVE-2021-31166 1 Microsoft 7 Windows 10 1809, Windows 10 2004, Windows 10 20h2 and 4 more 2025-10-30 9.8 Critical
HTTP Protocol Stack Remote Code Execution Vulnerability
CVE-2021-31199 1 Microsoft 22 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 19 more 2025-10-30 5.2 Medium
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability
CVE-2024-12987 1 Draytek 4 Vigor2960, Vigor2960 Firmware, Vigor300b and 1 more 2025-10-30 7.3 High
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.
CVE-2024-0769 1 Dlink 2 Dir-859, Dir-859 Firmware 2025-10-30 5.3 Medium
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DIR-859 1.06B01. It has been rated as critical. Affected by this issue is some unknown functionality of the file /hedwig.cgi of the component HTTP POST Request Handler. The manipulation of the argument service with the input ../../../../htdocs/webinc/getcfg/DHCPS6.BRIDGE-1.xml leads to path traversal. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-251666 is the identifier assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVE-2024-3273 1 Dlink 40 Dnr-202l, Dnr-202l Firmware, Dnr-322l and 37 more 2025-10-30 7.3 High
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument system leads to command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259284. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.
CVE-2024-3272 1 Dlink 40 Dnr-202l, Dnr-202l Firmware, Dnr-322l and 37 more 2025-10-30 9.8 Critical
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user with the input messagebus leads to hard-coded credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259283. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed immediately that the product is end-of-life. It should be retired and replaced.