Export limit exceeded: 339475 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (339475 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-3838 1 Wpupper Share Buttons Project 1 Wpupper Share Buttons 2025-04-23 4.8 Medium
The WPUpper Share Buttons WordPress plugin through 3.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVE-2022-39099 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2025-04-23 7.8 High
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
CVE-2022-39098 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2025-04-23 7.8 High
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
CVE-2022-39097 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2025-04-23 7.8 High
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
CVE-2022-39096 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2025-04-23 7.8 High
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
CVE-2022-39095 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2025-04-23 7.8 High
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
CVE-2022-39094 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2025-04-23 7.8 High
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
CVE-2022-39093 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2025-04-23 7.8 High
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
CVE-2022-39092 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2025-04-23 7.8 High
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
CVE-2022-39091 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2025-04-23 7.8 High
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
CVE-2022-39090 2 Google, Unisoc 14 Android, S8000, Sc7731e and 11 more 2025-04-23 7.8 High
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
CVE-2022-25630 1 Symantec 1 Messaging Gateway 2025-04-23 5.4 Medium
An authenticated user can embed malicious content with XSS into the admin group policy page.
CVE-2022-25629 1 Symantec 1 Messaging Gateway 2025-04-23 5.4 Medium
An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotations page (Annotation Text Column).
CVE-2022-1540 1 Postmagthemes 1 Postmagthemes Demo Import 2025-04-23 7.2 High
The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) leading to RCE.
CVE-2020-6627 1 Seagate 6 Stcg2000300, Stcg2000300 Firmware, Stcg3000300 and 3 more 2025-04-23 9.8 Critical
The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the "start" state and sending a check_device_name request.
CVE-2022-39906 1 Google 1 Android 2025-04-23 2.3 Low
Improper access control vulnerability in SecTelephonyProvider prior to SMR Dec-2022 Release 1 allows attackers to access message information.
CVE-2022-39907 1 Google 1 Android 2025-04-23 6.9 Medium
Integer overflow vulnerability in Samsung decoding library for video thumbnails prior to SMR Dec-2022 Release 1 allows local attacker to perform Out-Of-Bounds Write.
CVE-2021-38997 1 Ibm 1 Api Connect 2025-04-23 5.4 Medium
IBM API Connect V10.0.0.0 through V10.0.5.0, V10.0.1.0 through V10.0.1.7, and V2018.4.1.0 through 2018.4.1.19 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking. IBM X-Force ID: 213212.
CVE-2025-42603 2025-04-23 N/A
This vulnerability exists in the Meon KYC solutions due to transmission of sensitive data in plain text within the response payloads of certain API endpoints. An authenticated remote attacker could exploit this vulnerability by intercepting API response that contains unencrypted sensitive information belonging to other users. Successful exploitation of this vulnerability could allow remote attacker to impersonate the target user and gain unauthorized access to the user account.
CVE-2024-35048 2 Javahuang, Surveyking 2 Surveyking, Surveyking 2025-04-23 4.3 Medium
An issue in SurveyKing v1.3.1 allows attackers to execute a session replay attack after a user changes their password.