Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30925 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-22853 1 Dlink 2 Go-rt-ac750, Go-rt-ac750 Firmware 2025-06-20 9.8 Critical
D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain root access via a telnet session.
CVE-2024-22836 1 Akaunting 1 Akaunting 2025-06-20 9.8 Critical
An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. An attacker can manipulate the company locale when installing an app to execute system commands on the hosting server.
CVE-2023-46350 1 Innovadeluxe 1 Manufacturer Or Supplier Alphabetical Search 2025-06-20 9.8 Critical
SQL injection vulnerability in InnovaDeluxe "Manufacturer or supplier alphabetical search" (idxrmanufacturer) module for PrestaShop versions 2.0.4 and before, allows remote attackers to escalate privileges and obtain sensitive information via the methods IdxrmanufacturerFunctions::getCornersLink, IdxrmanufacturerFunctions::getManufacturersLike and IdxrmanufacturerFunctions::getSuppliersLike.
CVE-2024-24325 1 Totolink 2 A3300r, A3300r Firmware 2025-06-20 9.8 Critical
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParentalRules function.
CVE-2024-24324 1 Totolink 2 A8000ru, A8000ru Firmware 2025-06-20 9.8 Critical
TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow.
CVE-2024-22751 1 Dlink 2 Dir-882 A1, Dir-882 A1 Firmware 2025-06-20 9.8 Critical
D-Link DIR-882 DIR882A1_FW130B06 was discovered to contain a stack overflow via the sub_477AA0 function.
CVE-2024-22662 1 Totolink 2 A3700r, A3700r Firmware 2025-06-20 9.8 Critical
TOTOLINK A3700R_V9.1.2u.6165_20211012 has a stack overflow vulnerability via setParentalRules
CVE-2024-22660 1 Totolink 2 A3700r, A3700r Firmware 2025-06-20 9.8 Critical
TOTOLINK_A3700R_V9.1.2u.6165_20211012has a stack overflow vulnerability via setLanguageCfg
CVE-2024-20011 2 Google, Mediatek 18 Android, Mt6985, Mt8127 and 15 more 2025-06-20 9.8 Critical
In alac decoder, there is a possible information disclosure due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08441146; Issue ID: ALPS08441146.
CVE-2023-51887 1 Ctan 1 Mathtex 2025-06-20 9.8 Critical
Command Injection vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via crafted string in application URL.
CVE-2023-51839 1 Devicefarmer 1 Smartphone Test Farm 2025-06-20 9.1 Critical
DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm.
CVE-2023-38319 1 Opennds 1 Opennds 2025-06-20 9.8 Critical
An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the FAS key entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.
CVE-2023-38318 1 Opennds 1 Opennds 2025-06-20 9.8 Critical
An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the gateway FQDN entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands.
CVE-2021-42143 1 Contiki-ng 1 Tinydtls 2025-06-20 9.1 Critical
An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. An infinite loop bug exists during the handling of a ClientHello handshake message. This bug allows remote attackers to cause a denial of service by sending a malformed ClientHello handshake message with an odd length of cipher suites, which triggers an infinite loop (consuming all resources) and a buffer over-read that can disclose sensitive information.
CVE-2024-35079 1 Inxedu 1 Inxedu 2025-06-20 9.8 Critical
An arbitrary file upload vulnerability in the uploadAudio method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file.
CVE-2024-35080 2 Inexdu, Inxedu 2 Inexdu, Inxedu 2025-06-20 9.8 Critical
An arbitrary file upload vulnerability in the gok4 method of inxedu v2024.4 allows attackers to execute arbitrary code via uploading a crafted .jsp file.
CVE-2024-35570 1 Inxedu 1 Inxedu 2025-06-20 9.8 Critical
An arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute arbitrary code via uploading a crafted jsp file.
CVE-2024-31030 2 Keith-cullen, Keithcullen 2 Freecoap, Freecoap 2025-06-20 9.1 Critical
An issue in coap_msg.c in Keith Cullen's FreeCoAP v.0.7 allows remote attackers to cause a Denial of Service or potentially disclose information via a specially crafted packet.
CVE-2024-23751 1 Llamaindex 1 Llamaindex 2025-06-20 9.8 Critical
LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via "Drop the Students table" within English language input.
CVE-2023-51947 1 Actidata 2 Actinas Sl 2u-8 Rdx, Actinas Sl 2u-8 Rdx Firmware 2025-06-20 9.1 Critical
Improper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types of data without authentication.