Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (357868 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2022-43289 1 Entropymine 1 Deark 2025-04-17 7.8 High
Deark v.1.6.2 was discovered to contain a stack overflow via the do_prism_read_palette() function at /modules/atari-img.c.
CVE-2022-42947 1 Autodesk 1 Maya 2025-04-17 7.8 High
A maliciously crafted X_B file when parsed through Autodesk Maya 2023 and 2022 can be used to write beyond the allocated buffer. This vulnerability can lead to arbitrary code execution.
CVE-2022-42946 1 Autodesk 1 Maya 2025-04-17 7.1 High
Parsing a maliciously crafted X_B and PRT file can force Autodesk Maya 2023 and 2022 to read beyond allocated buffer. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
CVE-2022-42945 1 Autodesk 1 Dwg Trueview 2025-04-17 7.8 High
DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system.
CVE-2022-42453 1 Hcltech 1 Bigfix Platform 2025-04-17 6.9 Medium
There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with insufficient warnings when attempting to run the script.
CVE-2022-41993 1 Jacic 1 Electronic Bidding Core System 2025-04-17 6.1 Medium
Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.
CVE-2022-41418 1 Blogengine 1 Blogengine.net 2025-04-17 7.2 High
An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via uploading a crafted PNG file.
CVE-2022-40743 1 Apache 1 Traffic Server 2025-04-17 6.1 Medium
Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache poisoning attacks.This issue affects Apache Traffic Server: 9.0.0 to 9.1.3. Users should upgrade to 9.1.4 or later versions.
CVE-2022-40435 1 Employee Performance Evaluation System Project 1 Employee Performance Evaluation System 2025-04-17 4.8 Medium
Employee Performance Evaluation System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via adding new entries under the Departments and Designations module.
CVE-2022-3985 1 Wphowto 1 Videojs Html5 Player 2025-04-17 5.4 Medium
The Videojs HTML5 Player WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
CVE-2022-3937 1 Noorsplugin 1 Easy Video Player 2025-04-17 5.4 Medium
The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
CVE-2022-3832 1 External Media Project 1 External Media 2025-04-17 4.8 Medium
The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2022-37392 1 Apache 1 Traffic Server 2025-04-17 5.3 Medium
Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
CVE-2022-32749 1 Apache 1 Traffic Server 2025-04-17 7.5 High
Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under certain conditions. This issue affects Apache Traffic Server: from 8.0.0 through 9.1.3.
CVE-2021-33640 2 Fedoraproject, Openatom 2 Fedora, Openeuler 2025-04-17 6.2 Medium
After tar_close(), libtar.c releases the memory pointed to by pointer t. After tar_close() is called in the list() function, it continues to use pointer t: free_longlink_longname(t->th_buf) . As a result, the released memory is used (use-after-free).
CVE-2019-15119 1 Ehang-io 1 Nps 2025-04-17 5.5 Medium
lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user.
CVE-2022-40494 1 Ehang-io 1 Nps 2025-04-17 9.8 Critical
NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameters.
CVE-2025-31723 1 Jenkins 1 Simple Queue 2025-04-17 4.3 Medium
A cross-site request forgery (CSRF) vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to change and reset the build queue order.
CVE-2025-31724 1 Jenkins 1 Cadence Vmanager 2025-04-17 4.3 Medium
Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.
CVE-2025-31725 1 Jenkins 1 Monitor-remote-job 2025-04-17 5.5 Medium
Jenkins monitor-remote-job Plugin 1.0 stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system.