Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (588 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-29827 1 Microsoft 1 Azure Automation 2025-09-10 9.9 Critical
Improper Authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.
CVE-2025-29972 1 Microsoft 1 Azure Storage Resource Provider 2025-09-10 9.9 Critical
Server-Side Request Forgery (SSRF) in Azure allows an authorized attacker to perform spoofing over a network.
CVE-2025-30387 1 Microsoft 1 Azure Ai Document Intelligence Studio 2025-09-10 9.8 Critical
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-21311 1 Microsoft 3 Windows 11 24h2, Windows Server 2022 23h2, Windows Server 2025 2025-09-09 9.8 Critical
Windows NTLM V1 Elevation of Privilege Vulnerability
CVE-2025-21307 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-09-09 9.8 Critical
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
CVE-2025-21415 1 Microsoft 1 Azure Ai Face Service 2025-09-09 9.9 Critical
Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network.
CVE-2025-21298 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-09-09 9.8 Critical
Windows OLE Remote Code Execution Vulnerability
CVE-2025-59033 1 Microsoft 7 Windows, Windows 10, Windows 11 and 4 more 2025-09-09 9.8 Critical
The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (WDAC) policy. On systems that do not have hypervisor-protected code integrity (HVCI) enabled, entries that specify only the to-be-signed (TBS) part of the code signer certificate are properly blocked, but entries that specify the signing certificate’s TBS hash along with a 'FileAttribRef' qualifier (such as file name or version) will not be blocked. This vulnerability affects any Windows system that does not have HVCI enabled or supported (HVCI is available in Windows 10, Windows 11, and Windows Server 2016 and later). NOTE: The vendor states that the driver blocklist is intended for use with HVCI, while systems without HVCI should use App Control, and any custom blocklist entries require a granular approach for proper enforcement.
CVE-2025-49217 2 Microsoft, Trendmicro 3 Windows, Endpoint Encryption Policy Server, Trend Micro Endpoint Encryption 2025-09-08 9.8 Critical
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49213 but is in a different method.
CVE-2025-49216 2 Microsoft, Trendmicro 3 Windows, Endpoint Encryption Policy Server, Trend Micro Endpoint Encryption 2025-09-08 9.8 Critical
An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and modify product configurations on affected installations.
CVE-2025-49213 2 Microsoft, Trendmicro 3 Windows, Endpoint Encryption Policy Server, Trend Micro Endpoint Encryption 2025-09-08 9.8 Critical
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49212 but is in a different method.
CVE-2025-49212 2 Microsoft, Trendmicro 3 Windows, Endpoint Encryption Policy Server, Trend Micro Endpoint Encryption 2025-09-08 9.8 Critical
An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.
CVE-2025-49219 2 Microsoft, Trendmicro 2 Windows, Apex Central 2025-09-08 9.8 Critical
An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49220 but is in a different method.
CVE-2025-49220 2 Microsoft, Trendmicro 2 Windows, Apex Central 2025-09-08 9.8 Critical
An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected installations. Note that this vulnerability is similar to CVE-2025-49219 but is in a different method.
CVE-2020-17142 1 Microsoft 1 Exchange Server 2025-08-28 9.1 Critical
Microsoft Exchange Remote Code Execution Vulnerability
CVE-2020-17132 1 Microsoft 1 Exchange Server 2025-08-28 9.1 Critical
Microsoft Exchange Remote Code Execution Vulnerability
CVE-2025-36038 5 Hp, Ibm, Linux and 2 more 8 Hp-ux, Aix, I and 5 more 2025-08-26 9 Critical
IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially crafted sequence of serialized objects.
CVE-2025-26496 4 Linux, Microsoft, Salesforce and 1 more 6 Linux, Windows, Tableau Desktop and 3 more 2025-08-26 9.3 Critical
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVE-2025-4609 2 Google, Microsoft 2 Chrome, Windows 2025-08-26 9.6 Critical
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
CVE-2025-53770 1 Microsoft 1 Sharepoint Server 2025-08-23 9.8 Critical
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a comprehensive update to address this vulnerability. In the meantime, please make sure that the mitigation provided in this CVE documentation is in place so that you are protected from exploitation.