Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (7529 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-28087 1 Hp 1 Oneview 2025-02-03 5.5 Medium
An HPE OneView appliance dump may expose OneView user accounts
CVE-2023-28086 1 Hp 1 Oneview 2025-02-03 5.5 Medium
An HPE OneView appliance dump may expose proxy credential settings
CVE-2023-26567 1 Sangoma 1 Freepbx Linux 7 2025-02-03 8.1 High
Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables. This exposes cleartext authentication credentials for the Asterisk Database (MariaDB/MySQL) and Asterisk Manager Interface. For example, an attacker can make a /ari/asterisk/variable?variable=AMPDBPASS API call.
CVE-2023-28090 1 Hp 1 Oneview 2025-02-03 5.5 Medium
An HPE OneView appliance dump may expose SNMPv3 read credentials
CVE-2023-28089 1 Hp 1 Oneview 2025-02-03 7.1 High
An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules
CVE-2023-28088 1 Hp 1 Oneview 2025-02-03 7.8 High
An HPE OneView appliance dump may expose SAN switch administrative credentials
CVE-2023-28084 2 Hp, Hpe 2 Oneview, Oneview Global Dashboard 2025-02-03 5.5 Medium
HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens
CVE-2024-37060 1 Lfprojects 1 Mlflow 2025-02-03 8.8 High
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously crafted Recipe to execute arbitrary code on an end user’s system when run.
CVE-2024-37059 1 Lfprojects 1 Mlflow 2025-02-03 8.8 High
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploaded PyTorch model to run arbitrary code on an end user’s system when interacted with.
CVE-2024-37058 1 Lfprojects 1 Mlflow 2025-02-03 8.8 High
Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploaded Langchain AgentExecutor model to run arbitrary code on an end user’s system when interacted with.
CVE-2024-37057 1 Lfprojects 1 Mlflow 2025-02-03 8.8 High
Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uploaded Tensorflow model to run arbitrary code on an end user’s system when interacted with.
CVE-2024-37056 1 Lfprojects 1 Mlflow 2025-02-03 8.8 High
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaded LightGBM scikit-learn model to run arbitrary code on an end user’s system when interacted with.
CVE-2024-37055 1 Lfprojects 1 Mlflow 2025-02-03 8.8 High
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaded pmdarima model to run arbitrary code on an end user’s system when interacted with.
CVE-2024-37054 1 Lfprojects 1 Mlflow 2025-02-03 8.8 High
Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with.
CVE-2024-37053 1 Lfprojects 1 Mlflow 2025-02-03 8.8 High
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.
CVE-2024-37052 1 Lfprojects 1 Mlflow 2025-02-03 8.8 High
Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploaded scikit-learn model to run arbitrary code on an end user’s system when interacted with.
CVE-2024-57728 1 Simple-help 1 Simplehelp 2025-01-31 7.2 High
SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file (i.e. zip slip). This can be exploited to execute arbitrary code on the host in the context of the SimpleHelp server user.
CVE-2024-57395 2025-01-31 9.8 Critical
Password Vulnerability in Safety production process management system v1.0 allows a remote attacker to escalate privileges, execute arbitrary code and obtain sensitive information via the password and account number parameters.
CVE-2024-23733 2025-01-31 7.5 High
The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary username and a blank password to the /WmAdmin/#/login/ URI.
CVE-2022-38730 1 Docker 1 Desktop 2025-01-31 6.3 Medium
Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-root field inside the DaemonJSON field in the WindowsContainerStartRequest class. This allows exploiting a symlink vulnerability in ..\dataRoot\network\files\local-kv.db because of a TOCTOU race condition.