Export limit exceeded: 351254 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8277 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-41564 1 Tibco 2 Hawk, Operational Intelligence Hawk Redtail 2025-03-20 6.8 Medium
The Hawk Console component of TIBCO Software Inc.'s TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail contains a vulnerability that will return the EMS transport password and EMS SSL password to a privileged user. Affected releases are TIBCO Software Inc.'s TIBCO Hawk: versions 6.1.0 through 6.2.1 and TIBCO Operational Intelligence Hawk RedTail: versions 7.0.0 through 7.2.0.
CVE-2024-25142 1 Apache 1 Airflow 2025-03-20 5.5 Medium
Use of Web Browser Cache Containing Sensitive Information vulnerability in Apache Airflow.  Airflow did not return "Cache-Control" header for dynamic content, which in case of some browsers could result in potentially storing sensitive data in local cache of the browser. This issue affects Apache Airflow: before 2.9.2. Users are recommended to upgrade to version 2.9.2, which fixes the issue.
CVE-2024-9953 1 Cert 1 Vince 2025-03-20 4.9 Medium
A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restricts unpickling to prevent server crashes, this vulnerability could still disrupt operations.
CVE-2022-38111 1 Solarwinds 1 Orion Platform 2025-03-19 7.2 High
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
CVE-2024-47221 1 Rapidscada 1 Rapid Scada 2025-03-19 7.5 High
CheckUser in ScadaServerEngine/MainLogic.cs in Rapid SCADA through 5.8.4 allows an empty password.
CVE-2023-25191 1 Ami 1 Megarac Sp-x 2025-03-19 7.5 High
AMI MegaRAC SPX devices allow Password Disclosure through Redfish. The fixed versions are SPx_12-update-7.00 and SPx_13-update-5.00.
CVE-2023-23558 1 Eternal Terminal Project 1 Eternal Terminal 2025-03-19 6.3 Medium
In Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp. For example, a local attacker can create /tmp/.sentry-native-etserver with mode 0777 before the etserver process is started. The attacker can choose to read sensitive information from that file, or modify the information in that file.
CVE-2023-23466 1 Mediacp 1 Media Control Panel 2025-03-19 6.5 Medium
Media CP Media Control Panel latest version. Insufficiently protected credential change.
CVE-2023-23463 1 Sunellsecurity 14 Sn-adr3804e1, Sn-adr3804e1 Firmware, Sn-adr3808e1 and 11 more 2025-03-19 5.3 Medium
Sunell DVR, latest version, Insufficiently Protected Credentials (CWE-522) may be exposed through an unspecified request.
CVE-2022-43969 1 Ricoh 154 Im 2500, Im 2500 Firmware, Im 2702 and 151 more 2025-03-19 9.1 Critical
Ricoh mp_c4504ex devices with firmware 1.06 mishandle credentials.
CVE-2025-26473 1 Outbackpower 2 Mojave Inverter Oghi8048a, Mojave Inverter Oghi8048a Firmware 2025-03-19 7.5 High
The Mojave Inverter uses the GET method for sensitive information.
CVE-2022-38714 1 Ibm 2 Cloud Pak For Data, Datastage 2025-03-18 4.9 Medium
IBM DataStage on Cloud Pak for Data 4.0.6 to 4.5.2 stores sensitive credential information that can be read by a privileged user. IBM X-Force ID: 235060.
CVE-2022-47503 1 Solarwinds 1 Orion Platform 2025-03-18 7.2 High
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
CVE-2022-47504 1 Solarwinds 1 Orion Platform 2025-03-18 7.2 High
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
CVE-2022-47507 1 Solarwinds 1 Orion Platform 2025-03-18 7.2 High
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
CVE-2024-40596 1 Mediawiki 1 Mediawiki 2025-03-18 4.3 Medium
An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log events. (TimelineService does not support properly suppressing.)
CVE-2023-23836 1 Solarwinds 1 Orion Platform 2025-03-18 7.2 High
SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to the SolarWinds Web Console to execute arbitrary commands.
CVE-2023-24498 1 Netgear 2 Prosafe Fs726tp, Prosafe Fs726tp Firmware 2025-03-18 7.5 High
An uspecified endpoint in the web server of the switch does not properly authenticate the user identity, and may allow downloading a config page with the password to the switch in clear text.
CVE-2023-26234 1 Jd-gui Project 1 Jd-gui 2025-03-17 6.6 Medium
JD-GUI 1.6.6 allows deserialization via UIMainWindowPreferencesProvider.singleInstance.
CVE-2022-45599 1 Aztech 2 Wmb250ac, Wmb250ac Firmware 2025-03-17 9.8 Critical
Aztech WMB250AC Mesh Routers Firmware Version 016 2020 is vulnerable to PHP Type Juggling in file /var/www/login.php, allows attackers to gain escalated privileges only when specific conditions regarding a given accounts hashed password.