Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (328456 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-42733 1 Siemens 1 Syngo Dynamics Cardiovascular Imaging And Information System 2025-04-29 7.5 High
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website’s application pool.
CVE-2022-42096 1 Backdropcms 1 Backdrop Cms 2025-04-29 4.8 Medium
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content.
CVE-2022-40470 1 Phpgurukul 1 Blood Donor Management System 2025-04-29 4.8 Medium
Phpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature.
CVE-2022-3561 1 Librenms 1 Librenms 2025-04-29 6.1 Medium
Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0.
CVE-2022-37197 1 Iobit 1 Iotransfer 2025-04-29 7.8 High
IOBit IOTransfer V4 is vulnerable to Unquoted Service Path.
CVE-2022-36786 1 Dlink 2 Dsl-224, Dsl-224 Firmware 2025-04-29 9.9 Critical
DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is possible to inject a command through this interface that will run with ROOT permissions on the router.
CVE-2022-34827 1 Carel 2 Boss Mini, Boss Mini Firmware 2025-04-29 8.8 High
Carel Boss Mini 1.5.0 has Improper Access Control.
CVE-2021-31739 1 Seppmail 1 Seppmail 2025-04-29 6.1 Medium
The SEPPmail solution is vulnerable to a Cross-Site Scripting vulnerability (XSS), because user input is not correctly encoded in HTML attributes when returned by the server.SEPPmail 11.1.10 allows XSS via a recipient address.
CVE-2021-22141 1 Elastic 1 Kibana 2025-04-29 6.1 Medium
An open redirect flaw was found in Kibana versions before 7.13.0 and 6.8.16. If a logged in user visits a maliciously crafted URL, it could result in Kibana redirecting the user to an arbitrary website.
CVE-2022-3480 1 Phoenixcontact 62 Fl Mguard Centerport, Fl Mguard Centerport Firmware, Fl Mguard Centerport Vpn-1000 and 59 more 2025-04-29 7.5 High
A remote, unauthenticated attacker could cause a denial-of-service of PHOENIX CONTACT FL MGUARD and TC MGUARD devices below version 8.9.0 by sending a larger number of unauthenticated HTTPS connections originating from different source IP’s. Configuring firewall limits for incoming connections cannot prevent the issue.
CVE-2022-3461 1 Phoenixcontact 1 Automationworx Software Suite 2025-04-29 7.8 High
In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 manipulated PC Worx or Config+ files could lead to a heap buffer overflow and a read access violation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities.
CVE-2022-3893 1 Hallowelt 1 Bluespice 2025-04-29 2.3 Low
Cross-site Scripting (XSS) vulnerability in BlueSpiceCustomMenu extension of BlueSpice allows user with admin permissions to inject arbitrary HTML into the custom menu navigation of the application.
CVE-2024-13207 1 Patelmilap 1 Widget For Social Page Feeds 2025-04-29 4.8 Medium
The Widget for Social Page Feeds WordPress plugin before 6.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2022-3958 1 Hallowelt 1 Bluespice 2025-04-29 3.3 Low
Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the personal menu navigation of their own and other users. This allows for targeted attacks.
CVE-2022-41611 1 Hallowelt 1 Bluespice 2025-04-29 2.3 Low
Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navigation of the application.
CVE-2022-41789 1 Hallowelt 1 Bluespice 2025-04-29 3.3 Low
Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows logged in user with edit permissions to inject arbitrary HTML into the default page header of a wikipage.
CVE-2024-13610 1 Wpbrigade 1 Simple Social Buttons 2025-04-29 4.8 Medium
The Simple Social Media Share Buttons WordPress plugin before 6.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2023-42977 1 Apple 3 Ipad Os, Iphone Os, Macos 2025-04-29 7.8 High
A path handling issue was addressed with improved validation. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to break out of its sandbox.
CVE-2022-27895 1 Palantir 1 Foundry Build2 2025-04-29 4.2 Medium
Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as Build2. This issue was present in versions earlier than 1.785.0. Upgrade to Build2 version 1.785.0 or greater.
CVE-2023-42969 1 Apple 3 Ipados, Iphone Os, Macos 2025-04-29 3.3 Low
An app may be able to break out of its sandbox. This issue is fixed in iOS 17 and iPadOS 17, iOS 16.7 and iPadOS 16.7, macOS Sonoma 14, macOS Ventura 13.6, macOS Monterey 12.7. The issue was addressed with improved handling of caches.