Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (337346 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-22947 2 Oracle, Vmware 10 Commerce Guided Search, Communications Cloud Native Core Binding Support Function, Communications Cloud Native Core Console and 7 more 2025-10-30 10 Critical
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.
CVE-2022-22954 2 Linux, Vmware 6 Linux Kernel, Cloud Foundation, Identity Manager and 3 more 2025-10-30 9.8 Critical
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.
CVE-2022-22960 2 Linux, Vmware 6 Linux Kernel, Cloud Foundation, Identity Manager and 3 more 2025-10-30 7.8 High
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.
CVE-2025-12325 2 Mayurik, Sourcecodester 2 Best Salon Management System, Best Salon Management System 2025-10-30 7.3 High
A vulnerability has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/forgot-password.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2025-12333 2 Code-projects, Fabian 2 E-commerce Website, E-commerce Website 2025-10-30 4.3 Medium
A vulnerability has been found in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/supplier_add.php. The manipulation of the argument supp_name/supp_address leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2022-22963 3 Oracle, Redhat, Vmware 29 Banking Branch, Banking Cash Management, Banking Corporate Lending Process Management and 26 more 2025-10-30 9.8 Critical
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.
CVE-2022-22965 6 Cisco, Oracle, Redhat and 3 more 45 Cx Cloud Agent, Commerce Platform, Communications Cloud Native Core Automated Test Suite and 42 more 2025-10-30 9.8 Critical
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.
CVE-2021-1647 1 Microsoft 20 Security Essentials, System Center Endpoint Protection, Windows 10 1507 and 17 more 2025-10-30 7.8 High
Microsoft Defender Remote Code Execution Vulnerability
CVE-2021-1732 1 Microsoft 11 Windows 10 1803, Windows 10 1809, Windows 10 1909 and 8 more 2025-10-30 7.8 High
Windows Win32k Elevation of Privilege Vulnerability
CVE-2021-26411 1 Microsoft 16 Edge, Internet Explorer, Windows 10 1507 and 13 more 2025-10-30 8.8 High
Internet Explorer Memory Corruption Vulnerability
CVE-2021-26855 1 Microsoft 1 Exchange Server 2025-10-30 9.1 Critical
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26857 1 Microsoft 1 Exchange Server 2025-10-30 7.8 High
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-26858 1 Microsoft 1 Exchange Server 2025-10-30 7.8 High
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-27059 1 Microsoft 2 Excel, Office 2025-10-30 7.6 High
Microsoft Office Remote Code Execution Vulnerability
CVE-2021-27065 1 Microsoft 1 Exchange Server 2025-10-30 7.8 High
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-27085 1 Microsoft 7 Internet Explorer, Windows 10 1803, Windows 10 1809 and 4 more 2025-10-30 8.8 High
Internet Explorer Remote Code Execution Vulnerability
CVE-2021-28310 1 Microsoft 11 Windows 10 1803, Windows 10 1809, Windows 10 1909 and 8 more 2025-10-30 7.8 High
Win32k Elevation of Privilege Vulnerability
CVE-2021-31166 1 Microsoft 7 Windows 10 1809, Windows 10 2004, Windows 10 20h2 and 4 more 2025-10-30 9.8 Critical
HTTP Protocol Stack Remote Code Execution Vulnerability
CVE-2021-31199 1 Microsoft 22 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 19 more 2025-10-30 5.2 Medium
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability
CVE-2024-12987 1 Draytek 4 Vigor2960, Vigor2960 Firmware, Vigor300b and 1 more 2025-10-30 7.3 High
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argument session leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.5.1.5 is able to address this issue. It is recommended to upgrade the affected component.