Search

Expected end of text, found '/' (at char 36), (line:1, col:37)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (414602 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-45969 1 Alistgo 1 Alist 2026-02-13 9.8 Critical
Alist v3.4.0 is vulnerable to Directory Traversal,
CVE-2022-45970 1 Alistgo 1 Alist 2026-02-13 5.4 Medium
Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board.
CVE-2022-26533 1 Alistgo 1 Alist 2026-02-13 6.1 Medium
Alist v2.1.0 and below was discovered to contain a cross-site scripting (XSS) vulnerability via /i/:data/ipa.plist.
CVE-2022-45968 1 Alistgo 1 Alist 2026-02-13 8.8 High
Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one).
CVE-2024-47067 2 Alist Project, Alistgo 2 Alist, Alist 2026-02-13 6.1 Medium
AList is a file list program that supports multiple storages. AList contains a reflected cross-site scripting vulnerability in helper.go. The endpoint /i/:link_name takes in a user-provided value and reflects it back in the response. The endpoint returns an application/xml response, opening it up to HTML tags via XHTML and thus leading to a XSS vulnerability. This vulnerability is fixed in 3.29.0.
CVE-2025-68128 2026-02-13 N/A
reserved but not needed
CVE-2025-68127 2026-02-13 N/A
reserved but not needed
CVE-2025-68126 2026-02-13 N/A
reserved but not needed
CVE-2025-68125 2026-02-13 N/A
reserved but not needed
CVE-2025-68124 2026-02-13 N/A
reserved but not needed
CVE-2025-58184 2026-02-13 N/A
reserved but not needed
CVE-2025-58182 2026-02-13 N/A
reserved but not needed
CVE-2025-47915 2026-02-13 N/A
reserved but not needed
CVE-2024-34157 2026-02-13 N/A
reserved but not needed
CVE-2024-34154 2026-02-13 N/A
reserved but not needed
CVE-2025-63648 1 Owntone 2 Owntone-server, Owntone Server 2026-02-13 7.5 High
A NULL pointer dereference in the dacp_reply_playqueueedit_move function (src/httpd_dacp.c) of owntone-server commit b7e385f allows attackers to cause a Denial of Service (DoS) via sending a crafted DACP request to the server.
CVE-2025-57156 1 Owntone 2 Owntone-server, Owntone Server 2026-02-13 7.5 High
NULL pointer dereference in the dacp_reply_playqueueedit_clear function in src/httpd_dacp.c in owntone-server through commit 6d604a1 (newer commit after version 28.12) allows remote attackers to cause a Denial of Service (crash).
CVE-2021-38383 1 Owntone 1 Owntone Server 2026-02-13 9.8 Critical
OwnTone (aka owntone-server) through 28.1 has a use-after-free in net_bind() in misc.c.
CVE-2025-57155 1 Owntone 2 Owntone-server, Owntone Server 2026-02-13 7.5 High
NULL pointer dereference in the daap_reply_groups function in src/httpd_daap.c in owntone-server through commit 5e6f19a (newer commit after version 28.2) allows remote attackers to cause a Denial of Service.
CVE-2025-25652 1 Eptura 1 Archibus 2026-02-13 7.5 High
In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal.