Search

Expected end of text, found '/' (at char 45), (line:1, col:46)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (23555 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2024-13246 1 Node Access Rebuild Progressive Project 1 Node Access Rebuild Progressive 2025-06-04 5.3 Medium
Improper Ownership Management vulnerability in Drupal Node Access Rebuild Progressive allows Target Influence via Framing.This issue affects Node Access Rebuild Progressive: from 0.0.0 before 2.0.2.
CVE-2024-13260 1 Migrate Queue Importer Project 1 Migrate Queue Importer 2025-06-04 8.8 High
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Migrate queue importer allows Cross Site Request Forgery.This issue affects Migrate queue importer: from 0.0.0 before 2.1.1.
CVE-2024-13259 1 Image Sizes Project 1 Image Sizes 2025-06-04 7.5 High
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Image Sizes allows Forceful Browsing.This issue affects Image Sizes: from 0.0.0 before 3.0.2.
CVE-2024-13258 1 Rest \& Json Api Authentication Project 1 Rest \& Json Api Authentication 2025-06-04 9.8 Critical
Incorrect Authorization vulnerability in Drupal Drupal REST & JSON API Authentication allows Forceful Browsing.This issue affects Drupal REST & JSON API Authentication: from 0.0.0 before 2.0.13.
CVE-2024-13257 1 Commerce View Receipt Project 1 Commerce View Receipt 2025-06-04 5.3 Medium
Incorrect Authorization vulnerability in Drupal Commerce View Receipt allows Forceful Browsing.This issue affects Commerce View Receipt: from 0.0.0 before 1.0.3.
CVE-2024-13256 1 Email Contact Project 1 Email Contact 2025-06-04 7.5 High
Insufficient Granularity of Access Control vulnerability in Drupal Email Contact allows Forceful Browsing.This issue affects Email Contact: from 0.0.0 before 2.0.4.
CVE-2024-45033 1 Apache 1 Apache-airflow-providers-fab 2025-06-03 8.1 High
Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged users could continue to be logged in even after the password was changed. This only happened when the password was changed with CLI. The problem does not happen in case change was done with webserver thus this is different from  CVE-2023-40273 https://github.com/advisories/GHSA-pm87-24wq-r8w9  which was addressed in Apache-Airflow 2.7.0 Users are recommended to upgrade to version 1.5.2, which fixes the issue.
CVE-2024-55069 1 Ffmpeg 1 Ffmpeg 2025-06-03 5.3 Medium
ffmpeg 7.1 is vulnerable to Null Pointer Dereference in function iamf_read_header in /libavformat/iamfdec.c.
CVE-2023-42866 1 Apple 6 Ipados, Iphone Os, Macos and 3 more 2025-06-03 8.8 High
The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.5, iOS 16.6 and iPadOS 16.6, tvOS 16.6, Safari 16.6, watchOS 9.6. Processing web content may lead to arbitrary code execution.
CVE-2024-51508 1 Tiki 1 Tiki 2025-06-03 4.8 Medium
Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Index.
CVE-2024-51509 1 Tiki 1 Tiki 2025-06-03 4.8 Medium
Tiki through 27.0 allows users who have certain permissions to insert a "Modules" (aka tiki-admin_modules.php) stored XSS payload in the Name.
CVE-2024-51507 1 Tiki 1 Tiki 2025-06-03 4.8 Medium
Tiki through 27.0 allows users who have certain permissions to insert a "Create/Edit External Wiki" stored XSS payload in the Name.
CVE-2024-51506 1 Tiki 1 Tiki 2025-06-03 4.8 Medium
Tiki through 27.0 allows users who have certain permissions to insert a "Create a Wiki Pages" stored XSS payload in the description.
CVE-2025-47226 1 Snipeitapp 1 Snipe-it 2025-06-03 5 Medium
Grokability Snipe-IT before 8.1.0 has incorrect authorization for accessing asset information.
CVE-2022-43680 5 Debian, Fedoraproject, Libexpat Project and 2 more 24 Debian Linux, Fedora, Libexpat and 21 more 2025-05-30 7.5 High
In libexpat through 2.4.9, there is a use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate in out-of-memory situations.
CVE-2025-40582 1 Siemens 2 Scalance Lpe9403, Scalance Lpe9403 Firmware 2025-05-30 7.8 High
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions with SINEMA Remote Connect Edge Client installed). Affected devices do not properly sanitize configuration parameters. This could allow a non-privileged local attacker to execute root commands on the device.
CVE-2025-40583 1 Siemens 2 Scalance Lpe9403, Scalance Lpe9403 Firmware 2025-05-30 4.4 Medium
A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions with SINEMA Remote Connect Edge Client installed). Affected devices do transmit sensitive information in cleartext. This could allow a privileged local attacker to retrieve this sensitive information.
CVE-2023-35792 1 Vound-software 1 Intella Connect 2025-05-30 5.4 Medium
Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS).
CVE-2023-35791 1 Vound-software 1 Intella Connect 2025-05-30 6.1 Medium
Vound Intella Connect 2.6.0.3 has an Open Redirect vulnerability.
CVE-2023-50943 1 Apache 1 Airflow 2025-05-30 7.5 High
Apache Airflow, versions before 2.8.1, have a vulnerability that allows a potential attacker to poison the XCom data by bypassing the protection of "enable_xcom_pickling=False" configuration setting resulting in poisoned data after XCom deserialization. This vulnerability is considered low since it requires a DAG author to exploit it. Users are recommended to upgrade to version 2.8.1 or later, which fixes this issue.