Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (23785 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-30150 1 Shopware 1 Shopware 2025-09-10 5.3 Medium
Shopware 6 is an open commerce platform based on Symfony Framework and Vue. Through the store-api it is possible as a attacker to check if a specific e-mail address has an account in the shop. Using the store-api endpoint /store-api/account/recovery-password you get the response, which indicates clearly that there is no account for this customer. In contrast you get a success response if the account was found. This vulnerability is fixed in Shopware 6.6.10.3 or 6.5.8.17. For older versions of 6.4, corresponding security measures are also available via a plugin. For the full range of functions, we recommend updating to the latest Shopware version.
CVE-2025-9109 1 Portabilis 1 I-diario 2025-09-10 3.7 Low
A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. Affected by this vulnerability is an unknown functionality of the file /password/email of the component Password Recovery Endpoint. The manipulation results in observable response discrepancy. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitation appears to be difficult. The exploit has been released to the public and may be exploited.
CVE-2025-20032 1 Intel 7 Proset\/wireless Wifi, Wi-fi 6 Ax101, Wi-fi 6 Ax201 and 4 more 2025-09-10 7.9 High
Improper input validation for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.100 may allow a privileged user to potentially enable denial of service via local access.
CVE-2025-59016 1 Typo3 1 Typo3 2025-09-10 4.3 Medium
Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations.
CVE-2025-29955 1 Microsoft 3 Windows 11 24h2, Windows Server 2022 23h2, Windows Server 2025 2025-09-10 6.2 Medium
Improper input validation in Windows Hyper-V allows an unauthorized attacker to deny service locally.
CVE-2025-32703 1 Microsoft 3 Visual Studio 2017, Visual Studio 2019, Visual Studio 2022 2025-09-10 5.5 Medium
Insufficient granularity of access control in Visual Studio allows an authorized attacker to disclose information locally.
CVE-2025-29968 1 Microsoft 6 Windows Server 2008, Windows Server 2012, Windows Server 2016 and 3 more 2025-09-10 6.5 Medium
Improper input validation in Active Directory Certificate Services (AD CS) allows an authorized attacker to deny service over a network.
CVE-2025-21336 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-09-09 5.6 Medium
Windows Cryptographic Information Disclosure Vulnerability
CVE-2025-21370 1 Microsoft 3 Windows 11 22h2, Windows 11 23h2, Windows 11 24h2 2025-09-09 7.8 High
Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability
CVE-2025-21308 1 Microsoft 13 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 10 more 2025-09-09 6.5 Medium
Windows Themes Spoofing Vulnerability
CVE-2025-21230 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-09-09 7.5 High
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
CVE-2025-21344 1 Microsoft 1 Sharepoint Server 2025-09-09 7.8 High
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2025-21284 1 Microsoft 13 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 10 more 2025-09-09 5.5 Medium
Windows Virtual Trusted Platform Module Denial of Service Vulnerability
CVE-2025-21280 1 Microsoft 13 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 10 more 2025-09-09 5.5 Medium
Windows Virtual Trusted Platform Module Denial of Service Vulnerability
CVE-2025-21242 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-09-09 5.9 Medium
Windows Kerberos Information Disclosure Vulnerability
CVE-2025-21235 1 Microsoft 8 Windows 10 21h2, Windows 10 22h2, Windows 11 22h2 and 5 more 2025-09-09 7.8 High
Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability
CVE-2025-21234 1 Microsoft 8 Windows 10 21h2, Windows 10 22h2, Windows 11 22h2 and 5 more 2025-09-09 7.8 High
Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability
CVE-2025-21214 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-09-09 4.2 Medium
Windows BitLocker Information Disclosure Vulnerability
CVE-2025-43777 1 Liferay 2 Dxp, Portal 2025-09-09 N/A
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13 and 2024.Q1.1 through 2024.Q1.19 exposes "Internal Server Error" in the response body when a login attempt is made with a deleted Client Secret.
CVE-2025-40757 1 Siemens 2 Apogee Pxc, Talon Tc 2025-09-09 5.3 Medium
A vulnerability has been identified in APOGEE PXC Series (BACnet) (All versions), APOGEE PXC Series (P2 Ethernet) (All versions), TALON TC Series (BACnet) (All versions). Affected devices connected to the network allow unrestricted access to sensitive files, such as databases. This could allow an attacker to download encrypted .db file containing passwords.