Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (88023 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2024-41859 3 Adobe, Apple, Microsoft 3 After Effects, Macos, Windows 2024-09-13 7.8 High
After Effects versions 23.6.6, 24.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2024-44851 1 Perfexcrm 1 Perfex Crm 2024-09-13 5.4 Medium
A stored cross-site scripting (XSS) vulnerability in the Discussion section of Perfex CRM v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content parameter.
CVE-2024-44466 1 Comfast 2 Cf-xr11, Cf-xr11 Firmware 2024-09-13 9.8 Critical
COMFAST CF-XR11 V2.7.2 has a command injection vulnerability in function sub_424CB4. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter iface.
CVE-2024-6018 1 Scriptonite 1 Music Request Manager 2024-09-13 6.1 Medium
The Music Request Manager WordPress plugin through 1.3 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
CVE-2024-6019 1 Scriptonite 1 Music Request Manager 2024-09-13 6.1 Medium
The Music Request Manager WordPress plugin through 1.3 does not sanitise and escape incoming music requests, which could allow unauthenticated users to perform Cross-Site Scripting attacks against administrators
CVE-2024-6700 1 Pega 1 Infinity 2024-09-13 5.5 Medium
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with App name.
CVE-2024-6701 1 Pega 1 Infinity 2024-09-13 5.5 Medium
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an XSS issue with case type.
CVE-2024-6702 1 Pega 1 Infinity 2024-09-13 5.2 Medium
Pega Platform versions 8.1 to Infinity 24.1.2 are affected by an HTML Injection issue with Stage.
CVE-2020-24061 2 Kasda, Kasdanet 3 Kw5515, Kw5515, Kw5515 Firmware 2024-09-13 5.4 Medium
Cross Site Scripting (XSS) Vulnerability in Firewall menu in Control Panel in KASDA KW5515 version 4.3.1.0, allows attackers to execute arbitrary code and steal cookies via a crafted script
CVE-2024-8695 1 Docker 2 Desktop, Docker Desktop 2024-09-13 9.8 Critical
A remote code execution (RCE) vulnerability via crafted extension description/changelog could be abused by a malicious extension in Docker Desktop before 4.34.2.
CVE-2024-8696 1 Docker 2 Desktop, Docker Desktop 2024-09-13 9.8 Critical
A remote code execution (RCE) vulnerability via crafted extension publisher-url/additional-urls could be abused by a malicious extension in Docker Desktop before 4.34.2.
CVE-2024-8605 1 Code-projects 1 Inventory Management 2024-09-13 4.3 Medium
A vulnerability classified as problematic was found in code-projects Inventory Management 1.0. This vulnerability affects unknown code of the file /view/registration.php of the component Registration Form. The manipulation with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVE-2024-45406 1 Craftcms 1 Craft Cms 2024-09-13 5.5 Medium
Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.
CVE-2024-44872 2 Mozilo, Mozilocms 2 Mozilocms, Mozilocms 2024-09-13 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in moziloCMS v3.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload.
CVE-2024-8636 1 Google 1 Chrome 2024-09-13 8.8 High
Heap buffer overflow in Skia in Google Chrome prior to 128.0.6613.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVE-2024-43335 1 Cyberchimps 1 Responsive Blocks 2024-09-13 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks – WordPress Gutenberg Blocks allows Stored XSS.This issue affects Responsive Blocks – WordPress Gutenberg Blocks: from n/a through 1.8.8.
CVE-2024-43342 1 Bdthemes 1 Ultimate Store Kit 2024-09-13 6.5 Medium
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BdThemes Ultimate Store Kit Elementor Addons allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through 1.6.4.
CVE-2024-44073 1 Rust-bitcoin 1 Miniscript 2024-09-13 7.5 High
The Miniscript (aka rust-miniscript) library before 12.2.0 for Rust allows stack consumption because it does not properly track tree depth.
CVE-2024-7939 2 3ds, Dassault 2 3dexperience, 3dswymer 3dexperience 2024 2024-09-13 8.7 High
A stored Cross-site Scripting (XSS) vulnerability affecting 3DSwym in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
CVE-2024-7932 2 3ds, Dassault 2 3dexperience, 3dswymer 3dexperience 2024 2024-09-13 8.7 High
A stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer on Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.