Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (30903 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-21216 1 Google 1 Android 2025-05-29 9.8 Critical
In PMRChangeSparseMemOSMem of physmem_osmem_linux.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2022-41138 1 Zutty Project 1 Zutty 2025-05-29 9.8 Critical
In Zutty before 0.13, DECRQSS in text written to the terminal can achieve arbitrary code execution.
CVE-2022-38340 1 Safe 1 Fme Server 2025-05-29 9.1 Critical
Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload.
CVE-2017-20148 1 Debian 1 Logcheck 2025-05-29 9.8 Critical
In the ebuild package through logcheck-1.3.23.ebuild for Logcheck on Gentoo, it is possible to achieve root privilege escalation from the logcheck user because of insecure recursive chown calls.
CVE-2025-26817 1 Netwrix 1 Password Secure 2025-05-29 9.8 Critical
Netwrix Password Secure 9.2.0.32454 allows OS command injection.
CVE-2022-23126 1 Teslamate 1 Teslamate 2025-05-28 9.8 Critical
TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls.
CVE-2024-50966 2 Dingfanzu, Timgreen 2 Cms, Dingfanzu Cms 2025-05-28 9.3 Critical
dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addAdmin.
CVE-2024-20078 2 Google, Mediatek 21 Android, Mt6768, Mt6779 and 18 more 2025-05-28 9.8 Critical
In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08737250; Issue ID: MSV-1452.
CVE-2024-20080 4 Google, Linuxfoundation, Mediatek and 1 more 38 Android, Yocto, Mt2735 and 35 more 2025-05-28 9.8 Critical
In gnss service, there is a possible escalation of privilege due to improper certificate validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08720039; Issue ID: MSV-1424.
CVE-2025-4052 1 Google 1 Chrome 2025-05-28 9.8 Critical
Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)
CVE-2024-35409 1 Webidsupport 1 Webid 2025-05-28 9.8 Critical
WeBid 1.1.2 is vulnerable to SQL Injection via admin/tax.php.
CVE-2025-32444 1 Vllm 1 Vllm 2025-05-28 10 Critical
vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration with mooncake, are vulnerable to remote code execution due to using pickle based serialization over unsecured ZeroMQ sockets. The vulnerable sockets were set to listen on all network interfaces, increasing the likelihood that an attacker is able to reach the vulnerable ZeroMQ sockets to carry out an attack. vLLM instances that do not make use of the mooncake integration are not vulnerable. This issue has been patched in version 0.8.5.
CVE-2025-25775 1 Codeastro 1 Bus Ticket Booking System 2025-05-28 9.8 Critical
Codeastro Bus Ticket Booking System v1.0 is vulnerable to SQL injection via the kodetiket parameter in /BusTicket-CI/tiket/cekorder.
CVE-2023-41505 1 Code-projects 2 Student Enrollment, Student Enrollment In Php 2025-05-28 9.8 Critical
An arbitrary file upload vulnerability in the Add Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2022-37265 1 Stealjs 1 Steal 2025-05-28 9.8 Critical
Prototype pollution vulnerability in stealjs steal 2.2.4 via the alias variable in babel.js.
CVE-2023-31634 2 Teslamate, Teslamate Project 2 Teslamate, Teslamate 2025-05-28 9.8 Critical
In TeslaMate before 1.27.2, there is unauthorized access to port 4000 for remote viewing and operation of user data. After accessing the IP address for the TeslaMate instance, an attacker can switch the port to 3000 to enter Grafana for remote operations. At that time, the default username and password can be used to enter the Grafana management console without logging in, a related issue to CVE-2022-23126.
CVE-2025-28146 1 Edimax 2 Br-6478ac V3, Br-6478ac V3 Firmware 2025-05-28 9.8 Critical
Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via fota_url in /boafrm/formLtefotaUpgradeQuectel
CVE-2024-57768 1 Jfinaloa Project 1 Jfinaloa 2025-05-28 9.8 Critical
JFinalOA before v2025.01.01 was discovered to contain a SQL injection vulnerability via the component validRoleKey?sysRole.key.
CVE-2024-50704 1 Uniguest 1 Tripleplay 2025-05-28 10 Critical
Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially crafted HTTP POST request.
CVE-2024-50707 1 Uniguest 1 Tripleplay 2025-05-28 10 Critical
Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via the X-Forwarded-For header in an HTTP GET request.