Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (323683 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-43167 1 Rukovoditel 1 Rukovoditel 2025-05-08 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add".
CVE-2022-43166 1 Rukovoditel 1 Rukovoditel 2025-05-08 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Entity".
CVE-2022-43165 1 Rukovoditel 1 Rukovoditel 2025-05-08 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Value parameter after clicking "Create".
CVE-2022-43164 1 Rukovoditel 1 Rukovoditel 2025-05-08 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add".
CVE-2022-43039 1 Gpac 1 Gpac 2025-05-08 5.5 Medium
GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_isom_meta_restore_items_ref at /isomedia/meta.c.
CVE-2022-43038 1 Axiosys 1 Bento4 2025-05-08 6.5 Medium
Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadCache() function in mp42ts.
CVE-2022-43037 1 Axiosys 1 Bento4 2025-05-08 6.5 Medium
An issue was discovered in Bento4 1.6.0-639. There is a memory leak in the function AP4_File::ParseStream in /Core/Ap4File.cpp.
CVE-2022-43035 1 Axiosys 1 Bento4 2025-05-08 6.5 Medium
An issue was discovered in Bento4 v1.6.0-639. There is a heap-buffer-overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a Denial of Service (DoS), as demonstrated by mp42aac.
CVE-2022-43034 1 Axiosys 1 Bento4 2025-05-08 6.5 Medium
An issue was discovered in Bento4 v1.6.0-639. There is a heap buffer overflow vulnerability in the AP4_BitReader::SkipBits(unsigned int) function in mp42ts.
CVE-2022-43033 1 Axiosys 1 Bento4 2025-05-08 6.5 Medium
An issue was discovered in Bento4 1.6.0-639. There is a bad free in the component AP4_HdlrAtom::~AP4_HdlrAtom() which allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE-2022-43032 1 Axiosys 1 Bento4 2025-05-08 6.5 Medium
An issue was discovered in Bento4 v1.6.0-639. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp, as demonstrated by mp42aac.
CVE-2022-43029 1 Tenda 2 Tx3, Tx3 Firmware 2025-05-08 9.8 Critical
Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the time parameter at /goform/SetSysTimeCfg.
CVE-2022-43028 1 Tenda 2 Tx3, Tx3 Firmware 2025-05-08 9.8 Critical
Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter at /goform/SetSysTimeCfg.
CVE-2022-43027 1 Tenda 2 Tx3, Tx3 Firmware 2025-05-08 9.8 Critical
Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the firewallEn parameter at /goform/SetFirewallCfg.
CVE-2022-42466 1 Apache 1 Isis 2025-05-08 6.1 Medium
Prior to 2.0.0-M9, it was possible for an end-user to set the value of an editable string property of a domain object to a value that would be rendered unchanged when the value was saved. In particular, the end-user could enter javascript or similar and this would be executed. As of this release, the inputted strings are properly escaped when rendered.
CVE-2022-42227 1 Jsonlint Project 1 Jsonlint C\+\+ 2025-05-08 7.5 High
jsonlint 1.0 is vulnerable to heap-buffer-overflow via /home/hjsz/jsonlint/src/lexer.
CVE-2022-41709 1 Markdownify Project 1 Markdownify 2025-05-08 7.8 High
Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdown file through Markdownify. This is possible because the application has the "nodeIntegration" option enabled.
CVE-2022-41708 1 Relatedcode 1 Messenger 2025-05-08 4.3 Medium
Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access existing chats in the workspaces of any user of the application. This is possible because the application does not validate permissions correctly.
CVE-2022-41707 1 Relatedcode 1 Messenger 2025-05-08 6.5 Medium
Relatedcode's Messenger version 7bcd20b allows an authenticated external attacker to access sensitive data of any user of the application. This is possible because the application exposes user data to the public.
CVE-2022-40798 1 Ocomon Project 1 Ocomon 2025-05-08 7.5 High
OcoMon 4.0RC1 is vulnerable to Incorrect Access Control. Through a request the user can obtain the real email, sending the same request with correct email its possible to account takeover.