Search

Expected end of text, found ':' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (398752 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2017-5980 1 Gdraheim 1 Zziplib 2025-07-10 N/A
The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file.
CVE-2017-5979 1 Gdraheim 1 Zziplib 2025-07-10 N/A
The prescan_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a crafted ZIP file.
CVE-2017-5978 1 Gdraheim 1 Zziplib 2025-07-10 N/A
The zzip_mem_entry_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted ZIP file.
CVE-2018-6542 1 Gdraheim 1 Zziplib 2025-07-10 N/A
In ZZIPlib 0.13.67, there is a bus error (when handling a disk64_trailer seek value) caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c.
CVE-2018-6541 3 Canonical, Gdraheim, Redhat 3 Ubuntu Linux, Zziplib, Enterprise Linux 2025-07-10 N/A
In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address (when handling disk64_trailer local entries) in __zzip_fetch_disk_trailer (zzip/zip.c). Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.
CVE-2020-18770 2 Gdraheim, Redhat 2 Zziplib, Enterprise Linux 2025-07-10 5.5 Medium
An issue was discovered in function zzip_disk_entry_to_file_header in mmapped.c in zziplib 0.13.69, which will lead to a denial-of-service.
CVE-2018-6540 2 Canonical, Gdraheim 2 Ubuntu Linux, Zziplib 2025-07-10 N/A
In ZZIPlib 0.13.67, there is a bus error caused by loading of a misaligned address in the zzip_disk_findfirst function of zzip/mmapped.c. Remote attackers could leverage this vulnerability to cause a denial of service via a crafted zip file.
CVE-2024-32231 1 Stashapp 1 Stash 2025-07-10 6.3 Medium
Stash up to v0.25.1 was discovered to contain a SQL injection vulnerability via the sort parameter.
CVE-2024-45993 1 Giflib Project 1 Giflib 2025-07-10 6.5 Medium
Giflib Project v5.2.2 is vulnerable to a heap buffer overflow via gif2rgb.
CVE-2024-43346 1 Wow-company 1 Modal Window 2025-07-10 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wow-Company Modal Window allows Stored XSS.This issue affects Modal Window: from n/a through 6.0.3.
CVE-2024-45920 1 Solvait 1 Solvait 2025-07-10 5.4 Medium
A Stored Cross-Site Scripting (XSS) vulnerability in Solvait 24.4.2 allows remote attackers to inject malicious scripts into the application. This issue arises due to insufficient input validation and sanitization in "Intrest" feature.
CVE-2024-44860 1 Solvait 1 Solvait 2025-07-10 7.5 High
An information disclosure vulnerability in the /Letter/PrintQr/ endpoint of Solvait v24.4.2 allows attackers to access sensitive data via a crafted request.
CVE-2025-37097 1 Hpe 1 Insight Remote Support 2025-07-10 7.5 High
A vulnerability in HPE Insight Remote Support (IRS) prior to v7.15.0.646 may allow an unauthenticated denial of service
CVE-2024-41659 1 Usememos 1 Memos 2025-07-10 8.1 High
memos is a privacy-first, lightweight note-taking service. A CORS misconfiguration exists in memos 0.20.1 and earlier where an arbitrary origin is reflected with Access-Control-Allow-Credentials set to true. This may allow an attacking website to make a cross-origin request, allowing the attacker to read private information or make privileged changes to the system as the vulnerable user account. This vulnerability is fixed in 0.21.0.
CVE-2025-37098 1 Hpe 1 Insight Remote Support 2025-07-10 7.5 High
A path traversal vulnerability exists in HPE Insight Remote Support (IRS) prior to v7.15.0.646.
CVE-2024-46097 1 Testlink 1 Testlink 2025-07-10 8.1 High
TestLink 1.9.20 is vulnerable to Incorrect Access Control in the TestPlan editing section. When a new TestPlan is created, an ID with an incremental value is automatically generated. Using the edit function you can change the tplan_id parameter to another ID. The application does not carry out a check on the user's permissions maing it possible to recover the IDs of all the TestPlans (even the administrative ones) and modify them even with minimal privileges.
CVE-2024-25411 1 Flatpress 1 Flatpress 2025-07-10 6.1 Medium
A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter in setup.php.
CVE-2023-37230 1 Loftware 1 Spectrum 2025-07-10 8.8 High
Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF.
CVE-2024-44867 1 Phpok 1 Phpok 2025-07-10 7.5 High
phpok v3.0 was discovered to contain an arbitrary file read vulnerability via the component /autoload/file.php.
CVE-2025-53006 1 Dataease 1 Dataease 2025-07-10 9.8 Critical
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, in both PostgreSQL and Redshift, apart from parameters like "socketfactory" and "socketfactoryarg", there are also "sslfactory" and "sslfactoryarg" with similar functionality. The difference lies in that "sslfactory" and related parameters need to be triggered after establishing the connection. Other similar parameters include "sslhostnameverifier", "sslpasswordcallback", and "authenticationPluginClassName". This issue has been patched in 2.10.11.