Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9694 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-37376 1 Ivanti 1 Endpoint Manager 2025-05-01 7.2 High
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2024-34784 1 Ivanti 1 Endpoint Manager 2025-05-01 7.2 High
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2024-34782 1 Ivanti 1 Endpoint Manager 2025-05-01 7.2 High
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2024-34781 1 Ivanti 1 Endpoint Manager 2025-05-01 7.2 High
SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2022-40797 1 Roxyfileman 1 Roxy Fileman 2025-05-01 9.8 Critical
Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5 files. (Visiting any .phar file invokes the PHP interpreter in some realistic web-server configurations.)
CVE-2024-43425 1 Moodle 1 Moodle 2025-05-01 8.1 High
A flaw was found in Moodle. Additional restrictions are required to avoid a remote code execution risk in calculated question types. Note: This requires the capability to add/update questions.
CVE-2022-44089 1 Ecisp 1 Espcms 2025-05-01 9.8 Critical
ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component IS_GETCACHE.
CVE-2022-44088 1 Ecisp 1 Espcms 2025-05-01 9.8 Critical
ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRIPTION.
CVE-2022-44087 1 Ecisp 1 Espcms 2025-05-01 9.8 Critical
ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component UPFILE_PIC_ZOOM_HIGHT.
CVE-2022-43030 1 Siyucms 1 Siyucms 2025-05-01 7.2 High
Siyucms v6.1.7 was discovered to contain a remote code execution (RCE) vulnerability in the background. SIYUCMS is a content management system based on ThinkPaP5 AdminLTE. SIYUCMS has a background command execution vulnerability, which can be used by attackers to gain server privileges
CVE-2022-36938 1 Facebook 1 Redex 2025-05-01 9.8 Critical
DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially allowing remote code execution during processing of a 3rd party Android APK file.
CVE-2021-22931 5 Netapp, Nodejs, Oracle and 2 more 13 Active Iq Unified Manager, Nextgen Api, Oncommand Insight and 10 more 2025-04-30 9.8 Critical
Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames (leading to Domain Hijacking) and injection vulnerabilities in applications using the library.
CVE-2021-25943 1 101 Project 1 101 2025-04-30 9.8 Critical
Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25941 1 Deep-override Project 1 Deep-override 2025-04-30 9.8 Critical
Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25928 1 Manta 1 Safe-obj 2025-04-30 9.8 Critical
Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25927 1 Safe-flat Project 1 Safe-flat 2025-04-30 9.8 Critical
Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2024-11235 2 Php, Redhat 2 Php, Enterprise Linux 2025-04-30 8.1 High
In PHP versions 8.3.* before 8.3.19 and 8.4.* before 8.4.5, a code sequence involving __set handler or ??=  operator and exceptions can lead to a use-after-free vulnerability. If the third party can control the memory layout leading to this, for example by supplying specially crafted inputs to the script, it could lead to remote code execution.
CVE-2021-25916 1 Patchmerge Project 1 Patchmerge 2025-04-30 9.8 Critical
Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25915 1 Changeset Project 1 Changeset 2025-04-30 9.8 Critical
Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execution.
CVE-2021-25914 1 Fireblink 1 Object-collider 2025-04-30 9.8 Critical
Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution.