Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (601 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-34193 3 Microsoft, Printerlogic, Vasion 5 Windows, Vasion Print, Virtual Appliance and 2 more 2025-11-17 9.8 Critical
Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 include Windows client components (PrinterInstallerClientInterface.exe, PrinterInstallerClient.exe, PrinterInstallerClientLauncher.exe) that lack modern compile-time and runtime exploit mitigations and rely on outdated runtimes. These binaries are built as 32-bit, without Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), Control Flow Guard (CFG), or stack-protection, and they incorporate legacy technologies (Pascal/Delphi and Python 2) which are no longer commonly maintained. Several of these processes run with elevated privileges (NT AUTHORITY\SYSTEM for PrinterInstallerClient.exe and PrinterInstallerClientLauncher.exe), and the client automatically downloads and installs printer drivers. The absence of modern memory safety mitigations and the use of unmaintained runtimes substantially increase the risk that memory-corruption or other exploit primitives — for example from crafted driver content or maliciously crafted inputs — can be turned into remote or local code execution and privilege escalation to SYSTEM. This vulnerability has been confirmed to be remediated, but it is unclear as to when the patch was introduced.
CVE-2025-11719 2 Microsoft, Mozilla 3 Windows, Firefox, Thunderbird 2025-11-14 9.8 Critical
Starting in Thunderbird 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability affects Firefox < 144 and Thunderbird < 144.
CVE-2021-20021 2 Microsoft, Sonicwall 20 Windows, Email Security, Email Security Appliance 3300 and 17 more 2025-11-10 9.8 Critical
A vulnerability in the SonicWall Email Security version 10.0.9.x allows an attacker to create an administrative account by sending a crafted HTTP request to the remote host.
CVE-2025-53767 1 Microsoft 2 Azure, Azure Openai 2025-11-10 10 Critical
Azure OpenAI Elevation of Privilege Vulnerability
CVE-2025-53792 1 Microsoft 2 Azure, Azure Portal 2025-11-10 9.1 Critical
Azure Portal Elevation of Privilege Vulnerability
CVE-2025-53766 1 Microsoft 20 Gdi+, Gdiplus, Office and 17 more 2025-11-10 9.8 Critical
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
CVE-2025-50171 1 Microsoft 6 Server, Windows, Windows Server and 3 more 2025-11-10 9.1 Critical
Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-53795 1 Microsoft 1 Pc Manager 2025-11-10 9.1 Critical
Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-53763 1 Microsoft 1 Azure 2025-11-10 9.8 Critical
Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-26496 4 Linux, Microsoft, Salesforce and 1 more 6 Linux, Windows, Tableau Desktop and 3 more 2025-11-04 9.3 Critical
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Salesforce Tableau Server, Tableau Desktop on Windows, Linux (File Upload modules) allows Local Code Inclusion.This issue affects Tableau Server, Tableau Desktop: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVE-2024-4577 4 Fedoraproject, Microsoft, Php and 1 more 4 Fedora, Windows, Php and 1 more 2025-11-03 9.8 Critical
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use "Best-Fit" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.
CVE-2025-57870 4 Esri, Kubernetes, Linux and 1 more 5 Arcgis Server, Kubernetes, Linux and 2 more 2025-10-31 10 Critical
A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and Kubernetes. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary SQL commands via a specific ArcGIS Feature Service operation. Successful exploitation can potentially result in unauthorized access, modification, or deletion of data from the underlying Enterprise Geodatabase.
CVE-2020-4006 3 Linux, Microsoft, Vmware 7 Linux Kernel, Windows, Cloud Foundation and 4 more 2025-10-30 9.1 Critical
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.
CVE-2021-26855 1 Microsoft 1 Exchange Server 2025-10-30 9.1 Critical
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-31166 1 Microsoft 7 Windows 10 1809, Windows 10 2004, Windows 10 20h2 and 4 more 2025-10-30 9.8 Critical
HTTP Protocol Stack Remote Code Execution Vulnerability
CVE-2021-38647 1 Microsoft 12 Azure Automation State Configuration, Azure Automation Update Management, Azure Diagnostics and 9 more 2025-10-30 9.8 Critical
Open Management Infrastructure Remote Code Execution Vulnerability
CVE-2021-34523 1 Microsoft 1 Exchange Server 2025-10-30 9 Critical
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2023-36735 1 Microsoft 1 Edge Chromium 2025-10-30 9.6 Critical
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2021-34473 1 Microsoft 1 Exchange Server 2025-10-29 9.1 Critical
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2019-0604 1 Microsoft 3 Sharepoint Enterprise Server, Sharepoint Foundation, Sharepoint Server 2025-10-29 9.8 Critical
A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0594.