Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (87583 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-45699 1 Apsystems 2 Ecu-r, Ecu-r Firmware 2025-06-17 9.8 Critical
Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter.
CVE-2025-3902 1 Four Kitchens 1 Block Class 2025-06-17 6.1 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Class allows Cross-Site Scripting (XSS).This issue affects Block Class: from 4.0.0 before 4.0.1.
CVE-2025-29573 1 Jupo 1 Mezzanine 2025-06-16 6.1 Medium
Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module.
CVE-2023-49427 1 Tenda 2 Ax12, Ax12 Firmware 2025-06-16 7.5 High
Buffer Overflow vulnerability in Tenda AX12 V22.03.01.46, allows remote attackers to cause a denial of service (DoS) via list parameter in SetNetControlList function.
CVE-2023-32887 1 Mediatek 38 Mt2735, Mt6813, Mt6833 and 35 more 2025-06-16 7.5 High
In Modem IMS Stack, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01161837; Issue ID: MOLY01161837 (MSV-892).
CVE-2021-43584 1 Nagios 1 Nagios Cross Platform Agent 2025-06-16 4.8 Medium
DOM-based Cross Site Scripting (XSS vulnerability in 'Tail Event Logs' functionality in Nagios Nagios Cross-Platform Agent (NCPA) before 2.4.0 allows attackers to run arbitrary code via the name element when filtering for a log.
CVE-2025-29602 1 Flatpress 1 Flatpress 2025-06-16 6.1 Medium
flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.
CVE-2025-29746 1 Benjaminjonard 1 Koillection 2025-06-16 6.1 Medium
Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and album components
CVE-2023-47566 1 Qnap 3 Qts, Quts Hero, Qutscloud 2025-06-16 6.7 Medium
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.5.2645 build 20240116 and later QuTS hero h5.1.5.2647 build 20240118 and later QuTScloud c5.1.5.2651 and later
CVE-2024-23619 1 Ibm 1 Merge Efilm Workstation 2025-06-16 9.8 Critical
A hardcoded credential vulnerability exists in IBM Merge Healthcare eFilm Workstation. A remote, unauthenticated attacker can exploit this vulnerability to achieve information disclosure or remote code execution.
CVE-2024-25712 1 Http-swagger Project 1 Http-swagger 2025-06-16 6.1 Medium
http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFile) can subsequently be accessed via a GET request. NOTE: this is independently fixable with respect to CVE-2022-24863, because (if a solution continued to allow PUT requests) large files could have been blocked without blocking JavaScript, or JavaScript could have been blocked without blocking large files.
CVE-2024-22562 1 Swftools 1 Swftools 2025-06-16 7.8 High
swftools 0.9.2 was discovered to contain a Stack Buffer Underflow via the function dict_foreach_keyvalue at swftools/lib/q.c.
CVE-2024-21833 1 Tp-link 10 Archer Ax3000, Archer Ax3000 Firmware, Archer Ax5400 and 7 more 2025-06-16 8.8 High
Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi.
CVE-2024-21780 1 Kddi 2 Home Spot Cube 2, Home Spot Cube 2 Firmware 2025-06-16 7.5 High
Stack-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. Processing a specially crafted command may result in a denial of service (DoS) condition. Note that the affected products are no longer supported.
CVE-2023-51984 1 Dlink 2 Dir-822, Dir-822 Firmware 2025-06-16 9.8 Critical
D-Link DIR-822+ V1.0.2 was found to contain a command injection in SetStaticRouteSettings function. allows remote attackers to execute arbitrary commands via shell.
CVE-2023-51968 1 Tenda 2 Ax1803, Ax1803 Firmware 2025-06-16 9.8 Critical
Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function getIptvInfo.
CVE-2023-51960 1 Tenda 2 Ax1803, Ax1803 Firmware 2025-06-16 9.8 Critical
Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv.
CVE-2023-51939 1 Relic Project 1 Relic 2025-06-16 8.8 High
An issue in the cp_bbs_sig function in relic/src/cp/relic_cp_bbs.c of Relic relic-toolkit 0.6.0 allows a remote attacker to obtain sensitive information and escalate privileges via the cp_bbs_sig function.
CVE-2023-51889 1 Ctan 1 Mathtex 2025-06-16 9.8 Critical
Stack Overflow vulnerability in the validate() function in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via crafted string in the application URL.
CVE-2023-51246 1 Get-simple 1 Getsimplecms 2025-06-16 5.4 Medium
A Cross Site Scripting (XSS) vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user to add articles via the /admin/edit.php page.