Export limit exceeded: 417953 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417953 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417953 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-64292 | 1 Wordpress | 1 Wordpress | 2025-11-21 | 5.4 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PascalBajorat Analytics Germanized for Google Analytics ga-germanized allows DOM-Based XSS.This issue affects Analytics Germanized for Google Analytics: from n/a through <= 1.6.2. | ||||
| CVE-2025-54114 | 1 Microsoft | 16 Windows 10 1607, Windows 10 21h2, Windows 10 21h2 and 13 more | 2025-11-21 | 7 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2025-34125 | 1 Dlink | 1 Dsp-w215 Firmware | 2025-11-21 | N/A |
| An unauthenticated command injection vulnerability exists in the cookie handling process of the lighttpd web server on D-Link DSP-W110A1 firmware version 1.05B01. This occurs when specially crafted cookie values are processed, allowing remote attackers to execute arbitrary commands on the underlying Linux operating system. Successful exploitation enables full system compromise. | ||||
| CVE-2025-41735 | 2 Metz-connect, Metz Connect | 7 Ewio2-bm, Ewio2-bm Firmware, Ewio2-m and 4 more | 2025-11-21 | 8.8 High |
| A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution. | ||||
| CVE-2025-41737 | 2 Metz-connect, Metz Connect | 7 Ewio2-bm, Ewio2-bm Firmware, Ewio2-m and 4 more | 2025-11-21 | 7.5 High |
| Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules. | ||||
| CVE-2025-41736 | 2 Metz-connect, Metz Connect | 7 Ewio2-bm, Ewio2-bm Firmware, Ewio2-m and 4 more | 2025-11-21 | 8.8 High |
| A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution. | ||||
| CVE-2025-41734 | 2 Metz-connect, Metz Connect | 7 Ewio2-bm, Ewio2-bm Firmware, Ewio2-m and 4 more | 2025-11-21 | 9.8 Critical |
| An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices. | ||||
| CVE-2025-41733 | 2 Metz-connect, Metz Connect | 7 Ewio2-bm, Ewio2-bm Firmware, Ewio2-m and 4 more | 2025-11-21 | 9.8 Critical |
| The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials. | ||||
| CVE-2024-10203 | 1 Zohocorp | 1 Manageengine Endpoint Central | 2025-11-21 | 7 High |
| Zohocorp ManageEngine EndPoint Central versions 11.3.2416.21 and below, 11.3.2428.9 and below are vulnerable to Arbitrary File Deletion in the agent installed machines. | ||||
| CVE-2025-58034 | 1 Fortinet | 1 Fortiweb | 2025-11-21 | 6.7 Medium |
| An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands. | ||||
| CVE-2025-64446 | 1 Fortinet | 1 Fortiweb | 2025-11-21 | 9.4 Critical |
| A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests. | ||||
| CVE-2025-5601 | 1 Wireshark | 1 Wireshark | 2025-11-21 | 7.8 High |
| Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to 4.2.12 allows denial of service via packet injection or crafted capture file | ||||
| CVE-2025-30360 | 1 Webpack.js | 1 Webpack-dev-server | 2025-11-21 | 6.5 Medium |
| webpack-dev-server allows users to use webpack with a development server that provides live reloading. Prior to version 5.2.1, webpack-dev-server users' source code may be stolen when you access a malicious web site with non-Chromium based browser. The `Origin` header is checked to prevent Cross-site WebSocket hijacking from happening, which was reported by CVE-2018-14732. But webpack-dev-server always allows IP address `Origin` headers. This allows websites that are served on IP addresses to connect WebSocket. An attacker can obtain source code via a method similar to that used to exploit CVE-2018-14732. Version 5.2.1 contains a patch for the issue. | ||||
| CVE-2025-59220 | 1 Microsoft | 19 Windows, Windows 10, Windows 10 21h2 and 16 more | 2025-11-21 | 7 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2025-59251 | 1 Microsoft | 1 Edge Chromium | 2025-11-21 | 7.6 High |
| Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | ||||
| CVE-2025-55322 | 1 Microsoft | 1 Omniparser | 2025-11-21 | 7.3 High |
| Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2025-59216 | 1 Microsoft | 6 Windows, Windows 11, Windows 11 24h2 and 3 more | 2025-11-21 | 7 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2025-55244 | 1 Microsoft | 3 Azure, Azure Ai Bot Service, Azure Bot Service | 2025-11-21 | 9 Critical |
| Azure Bot Service Elevation of Privilege Vulnerability | ||||
| CVE-2025-55238 | 1 Microsoft | 3 365, Dynamics 365, Dynamics 365 Fasttrack Implementation | 2025-11-21 | 7.5 High |
| Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability | ||||
| CVE-2025-54914 | 1 Microsoft | 2 Azure, Azure Networking | 2025-11-21 | 10 Critical |
| Azure Networking Elevation of Privilege Vulnerability | ||||