Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30911 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-28441 1 Magicflue 1 Magicflue 2025-06-17 9.8 Critical
File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the messageid parameter of the mail/mailupdate.jsp endpoint.
CVE-2024-24593 1 Clear 1 Clearml 2025-06-17 9.6 Critical
A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform allows a remote attacker to impersonate a user by sending API requests via maliciously crafted html. Exploitation of the vulnerability allows an attacker to compromise confidential workspaces and files, leak sensitive information, and target instances of the ClearML platform within closed off networks.
CVE-2025-3927 1 Digigram 1 Pyko-out 2025-06-17 9.8 Critical
Digigram's PYKO-OUT audio-over-IP (AoIP) web-server does not require a password by default, allowing any attacker with the target IP address to connect and compromise the device, potentially pivoting to connected network or hardware devices.
CVE-2024-23630 1 Motorola 2 Mr2600, Mr2600 Firmware 2025-06-17 9 Critical
An arbitrary firmware upload vulnerability exists in the Motorola MR2600. An attacker can exploit this vulnerability to achieve code execution on the device. Authentication is required, however can be bypassed.
CVE-2023-52041 1 Totolink 2 X6000r, X6000r Firmware 2025-06-17 9.8 Critical
An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118 function of the shttpd program.
CVE-2023-51906 1 Yonyou 1 Yonbip 2025-06-17 9.8 Critical
An issue in yonyou YonBIP v3_23.05 allows a remote attacker to execute arbitrary code via a crafted script to the ServiceDispatcherServlet uap.framework.rc.itf.IResourceManager component.
CVE-2025-46724 1 Langroid 1 Langroid 2025-06-17 9.8 Critical
Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `TableChatAgent` uses `pandas eval()`. If fed by untrusted user input, like the case of a public-facing LLM application, it may be vulnerable to code injection. Langroid 0.53.15 sanitizes input to `TableChatAgent` by default to tackle the most common attack vectors, and added several warnings about the risky behavior in the project documentation.
CVE-2024-29385 1 Dlink 2 Dir-845l, Dir-845l Firmware 2025-06-17 9.0 Critical
DIR-845L router <= v1.01KRb03 has an Unauthenticated remote code execution vulnerability in the cgibin binary via soapcgi_main function.
CVE-2024-29858 2 Misp, Misp-project 2 Misp, Misp 2025-06-17 9.8 Critical
In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.
CVE-2024-29864 1 89luca89 1 Distrobox 2025-06-17 9.8 Critical
Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.
CVE-2024-27438 1 Apache 1 Doris 2025-06-17 9.8 Critical
Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code snippet. This code snippet will be run when catalog is initializing without any check. This issue affects Apache Doris: from 1.2.0 through 2.0.4. Users are recommended to upgrade to version 2.0.5 or 2.1.x, which fixes the issue.
CVE-2024-29866 1 Datalust 1 Seq 2025-06-17 9.1 Critical
Datalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner can escalate to System privileges.
CVE-2024-29243 1 Szlbt 3 Lbt-t300-mini1, Lbt-t300-mini1 Firmware, Lbt-t300-mini Firmware 2025-06-17 9.8 Critical
Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the vpn_client_ip parameter at /apply.cgi.
CVE-2022-45699 1 Apsystems 2 Ecu-r, Ecu-r Firmware 2025-06-17 9.8 Critical
Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter.
CVE-2024-29646 1 Radare 1 Radare2 2025-06-17 9.8 Critical
Buffer Overflow vulnerability in radarorg radare2 v.5.8.8 allows an attacker to execute arbitrary code via the name, type, or group fields.
CVE-2024-52533 4 Debian, Gnome, Netapp and 1 more 5 Debian Linux, Glib, Active Iq Unified Manager and 2 more 2025-06-17 9.8 Critical
gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4_CONN_MSG_LEN is not sufficient for a trailing '\0' character.
CVE-2024-50648 2 Guchengwuyue, Yshopmall 2 Yshopmall, Yshopmall 2025-06-17 9.8 Critical
yshopmall V1.0 has an arbitrary file upload vulnerability, which can enable RCE or even take over the server when improperly configured to parse JSP files.
CVE-2024-50649 2 Python Book, Timgreen 2 Python Book, Python Book 2025-06-17 9.8 Critical
The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.
CVE-2025-45607 1 Liaoxuefeng 1 Itranswarp 2025-06-16 9.8 Critical
An issue in the component /manage/ of itranswarp v2.19 allows attackers to bypass authentication via a crafted request.
CVE-2024-23740 1 Getkap 1 Kap 2025-06-16 9.8 Critical
An issue in Kap for macOS version 3.6.0 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings.