Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (331705 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-48834 1 Phpjabbers 1 Car Rental Script 2025-05-28 7.5 High
A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion.
CVE-2023-46307 1 Buddho 1 Etcd Browser 2025-05-28 7.5 High
An issue was discovered in server.js in etcd-browser 87ae63d75260. By supplying a /../../../ Directory Traversal input to the URL's GET request while connecting to the remote server port specified during setup, an attacker can retrieve local operating system files from the remote system.
CVE-2023-45210 1 Pleasanter 1 Pleasanter 2025-05-28 4.3 Medium
Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view the temporary files uploaded by other users who are not permitted to access.
CVE-2023-43304 1 Linecorp 1 Line 2025-05-28 8.2 High
An issue in PARK DANDAN mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token.
CVE-2023-40301 1 Netscout 1 Ngeniuspulse 2025-05-28 9.8 Critical
NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability.
CVE-2022-41228 1 Jenkins 1 Ns-nd Integration Performance Publisher 2025-05-28 8.8 High
A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials.
CVE-2022-41227 1 Jenkins 1 Ns-nd Integration Performance Publisher 2025-05-28 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers to connect to an attacker-specified webserver using attacker-specified credentials.
CVE-2022-41226 1 Jenkins 1 Compuware Common Configuration 2025-05-28 9.8 Critical
Jenkins Compuware Common Configuration Plugin 1.0.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-41225 1 Jenkins 1 Anchore Container Image Scanner 2025-05-28 5.4 Medium
Jenkins Anchore Container Image Scanner Plugin 1.0.24 and earlier does not escape content provided by the Anchore engine API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control API responses by Anchore engine.
CVE-2022-41224 1 Jenkins 1 Jenkins 2025-05-28 5.4 Medium
Jenkins 2.367 through 2.369 (both inclusive) does not escape tooltips of the l:helpIcon UI component used for some help icons on the Jenkins web UI, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control tooltips for this component.
CVE-2022-41222 5 Canonical, Debian, Linux and 2 more 7 Ubuntu Linux, Debian Linux, Linux Kernel and 4 more 2025-05-28 7 High
mm/mremap.c in the Linux kernel before 5.13.3 has a use-after-free via a stale TLB because an rmap lock is not held during a PUD move.
CVE-2022-41218 3 Debian, Linux, Redhat 5 Debian Linux, Linux Kernel, Enterprise Linux and 2 more 2025-05-28 5.5 Medium
In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.
CVE-2022-40357 1 Zblogcn 1 Z-blogphp 2025-05-28 9.8 Critical
A security issue was discovered in Z-BlogPHP <= 1.7.2. A Server-Side Request Forgery (SSRF) vulnerability in the zb_users/plugin/UEditor/php/action_crawler.php file allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the source parameter.
CVE-2022-40009 1 Swftools 1 Swftools 2025-05-28 9.8 Critical
SWFTools commit 772e55a was discovered to contain a heap-use-after-free via the function grow_unicode at /lib/ttf.c.
CVE-2022-40008 1 Swftools 1 Swftools 2025-05-28 9.8 Critical
SWFTools commit 772e55a was discovered to contain a heap-buffer overflow via the function readU8 at /lib/ttf.c.
CVE-2022-38955 1 Netgear 2 Wpn824ext, Wpn824ext Firmware 2025-05-28 7.5 High
An exploitable firmware modification vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM attack to modify the user-uploaded firmware image and bypass the CRC check. A successful attack can either introduce a backdoor to the device or make the device DoS. This affects Firmware Version: 1.1.1_1.1.9.
CVE-2022-38931 1 Baijiacms Project 1 Baijiacms 2025-05-28 8.8 High
A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter.
CVE-2022-38619 1 Bpcbt 1 Smartvista Front-end 2025-05-28 9.8 Critical
SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf.
CVE-2022-38178 5 Debian, Fedoraproject, Isc and 2 more 8 Debian Linux, Fedora, Bind and 5 more 2025-05-28 7.5 High
By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
CVE-2022-38177 5 Debian, Fedoraproject, Isc and 2 more 8 Debian Linux, Fedora, Bind and 5 more 2025-05-28 7.5 High
By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.