Export limit exceeded: 367106 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (367106 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-59694 1 Entrust 11 Nshield 5c, Nshield 5c Firmware, Nshield Connect Xc and 8 more 2025-12-15 6.8 Medium
The Chassis Management Board in Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allows a physically proximate attacker to persistently modify firmware and influence the (insecurely configured) appliance boot process. To exploit this, the attacker must modify the firmware via JTAG or perform an upgrade to the chassis management board firmware. This is called F03.
CVE-2025-59695 1 Entrust 11 Nshield 5c, Nshield 5c Firmware, Nshield Connect Xc and 8 more 2025-12-15 9.8 Critical
Entrust nShield Connect XC, nShield 5c, and nShield HSMi through 13.6.11, or 13.7, allow a user with OS root access to alter firmware on the Chassis Management Board (without Authentication). This is called F04.
CVE-2023-36690 1 Vibethemes 1 Wordpress Learning Management System 2025-12-15 8.1 High
Cross-Site Request Forgery (CSRF) vulnerability in VibeThemes WPLMS theme <= 4.900 versions.
CVE-2025-67907 2025-12-15 N/A
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2025-67906. Reason: This candidate is a reservation duplicate of CVE-2025-67906. Notes: All CVE users should reference CVE-2025-67906 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.
CVE-2025-13832 2025-12-13 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2025-67871 2025-12-13 N/A
Not used
CVE-2025-67870 2025-12-13 N/A
Not used
CVE-2025-67869 2025-12-13 N/A
Not used
CVE-2025-67868 2025-12-13 N/A
Not used
CVE-2025-67867 2025-12-13 N/A
Not used
CVE-2025-67866 2025-12-13 N/A
Not used
CVE-2025-67865 2025-12-13 N/A
Not used
CVE-2025-67864 2025-12-13 N/A
Not used
CVE-2025-67863 2025-12-13 N/A
Not used
CVE-2025-14066 2025-12-12 N/A
This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2025-43830 1 Liferay 4 Digital Experience Platform, Dxp, Liferay Portal and 1 more 2025-12-12 6.1 Medium
Stored cross-site scripting (XSS) vulnerability in Forms in Liferay Portal 7.3.2 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and 7.3 GA through update 35 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into a form with a rich text type field.
CVE-2025-62246 1 Liferay 4 Digital Experience Platform, Dxp, Liferay Portal and 1 more 2025-12-12 5.4 Medium
Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, 7.4 GA through update 92, and older unsupported versions allow remote authenticated users to inject arbitrary web script or HTML via a crafted payload injected into a user’s first, middle or last name text field to (1) page comments widget, (2) blog entry comments, (3) document and media document comments, (4) message board messages, (5) wiki page comments or (6) other widgets/apps that supports mentions.
CVE-2025-62253 1 Liferay 4 Digital Experience Platform, Dxp, Liferay Portal and 1 more 2025-12-12 6.1 Medium
Open redirect vulnerability in page administration in Liferay Portal 7.4.0 through 7.4.3.97, and older unsupported versions, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions allows remote attackers to redirect users to arbitrary external URLs via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter.
CVE-2025-62255 1 Liferay 4 Digital Experience Platform, Dxp, Liferay Portal and 1 more 2025-12-12 6.1 Medium
Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page in Liferay Portal 7.4.0 through 7.4.3.101, and older unsupported versions, and Liferay DXP 2023.Q3.1 through 2023.Q3.5, 7.4 GA through update 92, and older unsupported versions allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected into an attachment's filename.
CVE-2025-62249 1 Liferay 4 Digital Experience Platform, Dxp, Liferay Portal and 1 more 2025-12-12 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q3.0 through 2025.Q3.2, 2025.Q2.0 through 2025.Q2.12, 2025.Q1.0 through 2025.Q1.17, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.20, and 2023.Q4.0 through 2023.Q4.10 allows an remote non-authenticated attacker to inject JavaScript into the google_gadget.