Search

Expected end of text, found ':' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (385751 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-22251 1 Juniper 2 Csrx, Junos 2025-05-08 7.8 High
On cSRX Series devices software permission issues in the container filesystem and stored files combined with storing passwords in a recoverable format in Juniper Networks Junos OS allows a local, low-privileged attacker to elevate their permissions to take control of any instance of a cSRX software deployment. This issue affects Juniper Networks Junos OS 20.2 version 20.2R1 and later versions prior to 21.2R1 on cSRX Series.
CVE-2024-25454 1 Axiosys 1 Bento4 2025-05-08 5.5 Medium
Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_DescriptorFinder::Test() function.
CVE-2024-25407 1 Steve-community 1 Steve 2025-05-08 7.5 High
SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. This vulnerability can allow attackers to cause a Denial of Service (DoS) by using the predicted transaction ID's to terminate other transactions.
CVE-2024-25302 1 Remyandrade 1 Event Student Attendance System 2025-05-08 9.8 Critical
Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter.
CVE-2024-25003 1 9bis 1 Kitty 2025-05-08 7.8 High
KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insufficient bounds checking and input sanitization. This allows an attacker to overwrite adjacent memory, which leads to arbitrary code execution.
CVE-2024-24350 1 Softwarepublico 1 E-sic Livre 2025-05-08 8.8 High
File Upload vulnerability in Software Publico e-Sic Livre v.2.0 and before allows a remote attacker to execute arbitrary code via the extension filtering component.
CVE-2024-24255 1 Dronecode 1 Px4 Drone Autopilot 2025-05-08 4.2 Medium
A Race Condition discovered in geofence.cpp and mission_feasibility_checker.cpp in PX4 Autopilot 1.14 and earlier allows attackers to send drones on unintended missions.
CVE-2024-24216 1 Easycorp 1 Zentao 2025-05-08 9.8 Critical
Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php.
CVE-2024-24186 1 Jsish 1 Jsish 2025-05-08 9.8 Critical
Jsish v3.5.0 (commit 42c694c) was discovered to contain a stack-overflow via the component IterGetKeysCallback at /jsish/src/jsiValue.c.
CVE-2024-24112 1 Exrick 1 Xmall 2025-05-08 9.8 Critical
xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
CVE-2024-24003 1 Jishenghua 1 Jsherp 2025-05-08 9.8 Critical
jshERP v3.3 is vulnerable to SQL Injection. The com.jsh.erp.controller.DepotHeadController: com.jsh.erp.utils.BaseResponseInfo findInOutMaterialCount() function of jshERP does not filter `column` and `order` parameters well enough, and an attacker can construct malicious payload to bypass jshERP's protection mechanism in `safeSqlParse` method for sql injection.
CVE-2024-22515 1 Ispyconnect 1 Agent Dvr 2025-05-08 8.8 High
Unrestricted File Upload vulnerability in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to upload arbitrary files via the upload audio component.
CVE-2024-22012 1 Google 1 Android 2025-05-08 7.8 High
there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2022-43435 1 Jenkins 1 360 Fireline 2025-05-08 5.3 Medium
Jenkins 360 FireLine Plugin 1.7.2 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
CVE-2022-43434 1 Jenkins 1 Neuvector Vulnerability Scanner 2025-05-08 5.3 Medium
Jenkins NeuVector Vulnerability Scanner Plugin 1.20 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
CVE-2022-43433 1 Jenkins 1 Screenrecorder 2025-05-08 4.3 Medium
Jenkins ScreenRecorder Plugin 0.7 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
CVE-2022-43432 1 Jenkins 1 Xframium Builder 2025-05-08 4.3 Medium
Jenkins XFramium Builder Plugin 1.0.22 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download.
CVE-2022-43431 1 Jenkins 1 Compuware Strobe Measurement 2025-05-08 4.3 Medium
Jenkins Compuware Strobe Measurement Plugin 1.0.1 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.
CVE-2022-43430 1 Jenkins 1 Compuware Topaz For Total Test 2025-05-08 7.5 High
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.
CVE-2022-43429 1 Jenkins 2 Compuware Topaz For Total Test, Jenkins 2025-05-08 7.5 High
Jenkins Compuware Topaz for Total Test Plugin 2.4.8 and earlier implements an agent/controller message that does not limit where it can be executed, allowing attackers able to control agent processes to read arbitrary files on the Jenkins controller file system.