Search

Expected end of text, found ':' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (347351 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-33258 1 Powerdns 1 Recursor 2026-04-28 5.3 Medium
By publishing and querying a crafted zone an attacker can cause allocation of large entries in the negative and aggressive NSEC(3) caches.
CVE-2026-42379 2 Wordpress, Wpdevteam 2 Wordpress, Templately 2026-04-28 7.7 High
Insertion of Sensitive Information Into Sent Data vulnerability in WPDeveloper Templately allows Retrieve Embedded Sensitive Data.This issue affects Templately: from n/a through 3.6.1.
CVE-2026-31166 1 Totolink 2 A3300r, A3300r Firmware 2026-04-28 6.5 Medium
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the hour parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31167 1 Totolink 2 A3300r, A3300r Firmware 2026-04-28 6.5 Medium
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the mode parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31169 1 Totolink 2 A3300r, A3300r Firmware 2026-04-28 6.5 Medium
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the week parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31173 1 Totolink 2 A3300r, A3300r Firmware 2026-04-28 6.5 Medium
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the interval parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31177 1 Totolink 2 A3300r, A3300r Firmware 2026-04-28 9.8 Critical
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunMinAlive parameter to /cgi-bin/cstecgi.cgi.
CVE-2025-50229 1 Jizhicms 1 Jizhicms 2026-04-28 9.8 Critical
Jizhicms v2.5.4 is vulnerable to SQL injection in the product editing module.
CVE-2026-31159 1 Totolink 2 A3300r, A3300r Firmware 2026-04-28 6.5 Medium
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the password parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31160 1 Totolink 2 A3300r, A3300r Firmware 2026-04-28 6.5 Medium
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the provider parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31165 1 Totolink 2 A3300r, A3300r Firmware 2026-04-28 6.5 Medium
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the pppoeServiceName parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-31175 1 Totolink 2 A3300r, A3300r Firmware 2026-04-28 9.8 Critical
An issue was discovered in ToToLink A3300R firmware v17.0.0cu.557_B20221024 allowing attackers to execute arbitrary commands via the stunEnable parameter to /cgi-bin/cstecgi.cgi.
CVE-2026-6920 3 Google, Linux, Microsoft 4 Android, Chrome, Linux Kernel and 1 more 2026-04-28 9.6 Critical
Out of bounds read in GPU in Google Chrome on Android prior to 147.0.7727.117 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVE-2026-6921 3 Google, Linux, Microsoft 4 Android, Chrome, Linux Kernel and 1 more 2026-04-28 8.3 High
Race in GPU in Google Chrome on Windows prior to 147.0.7727.117 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Medium)
CVE-2025-59308 1 Mahara 1 Mahara 2026-04-28 4.7 Medium
In Mahara before 24.04.10 and 25 before 25.04.1, an institution administrator or institution support administrator on a multi-tenanted site can masquerade as an institution member in an institution for which they are not an administrator, if they also have the 'Site staff' role.
CVE-2025-61872 1 Mahara 1 Mahara 2026-04-28 6.1 Medium
Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. This occurs in the 'search site' feature when using the Elasticsearch7 search plugin. The Elasticsearch function does not properly sanitize input in the query parameter.
CVE-2025-67259 1 Classroomio 1 Classroomio 2026-04-28 6.5 Medium
A Broken Access Control vulnerability exists in ClassroomIO v0.1.13 where an authenticated low-privileged "student" user can access unauthorized course-level information by modifying intercepted API requests. Changing a captured POST request to a GET request against the /rest/v1/course PostgREST endpoint results in disclosure of sensitive information including other students details, tutor/admin profiles, and internal course metadata.
CVE-2026-31050 1 Hostbillapp 1 Hostbill 2026-04-28 4.9 Medium
Cross Site Scripting vulnerability in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to execute arbitrary code
CVE-2026-31052 1 Hostbillapp 1 Hostbill 2026-04-28 5.3 Medium
An issue in Hostbill v.2025-11-24 and 2025-12-01 allows a remote attacker to cause a denial of service via the Checkout Authentication Flow component
CVE-2026-41066 1 Lxml 1 Lxml 2026-04-28 7.5 High
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.0, using either of the two parsers in the default configuration (with resolve_entities=True) allows untrusted XML input to read local files. Setting the resolve_entities option explicitly to resolve_entities='internal' or resolve_entities=False disables the local file access. This vulnerability is fixed in 6.1.0.