Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9554 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2024-38121 1 Microsoft 6 Windows Server 2008, Windows Server 2012, Windows Server 2016 and 3 more 2025-07-10 8.8 High
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-38116 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-07-10 8.8 High
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
CVE-2024-38115 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-07-10 8.8 High
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
CVE-2024-38114 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-07-10 8.8 High
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
CVE-2024-38063 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-07-10 9.8 Critical
Windows TCP/IP Remote Code Execution Vulnerability
CVE-2024-38209 1 Microsoft 1 Edge Chromium 2025-07-10 7.8 High
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2024-38199 1 Microsoft 15 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 12 more 2025-07-10 9.8 Critical
Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability
CVE-2024-38172 1 Microsoft 2 365 Apps, Office Long Term Servicing Channel 2025-07-10 7.8 High
Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-38161 1 Microsoft 8 Windows 10 1809, Windows 10 21h2, Windows 10 22h2 and 5 more 2025-07-10 6.8 Medium
Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-38160 1 Microsoft 2 Windows 10 1607, Windows Server 2016 2025-07-10 9.1 Critical
Windows Network Virtualization Remote Code Execution Vulnerability
CVE-2024-38159 1 Microsoft 2 Windows 10 1607, Windows Server 2016 2025-07-10 9.1 Critical
Windows Network Virtualization Remote Code Execution Vulnerability
CVE-2024-5717 1 Logsign 2 Unified Secops, Unified Secops Platform 2025-07-10 N/A
Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the implementation of the HTTP API. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24165.
CVE-2024-5718 1 Logsign 2 Unified Secops, Unified Secops Platform 2025-07-10 8.1 High
Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the cluster HTTP API, which listens on TCP port 1924 by default when enabled. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24166.
CVE-2024-5719 1 Logsign 2 Unified Secops, Unified Secops Platform 2025-07-10 N/A
Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the implementation of the HTTP API. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24167.
CVE-2024-5720 1 Logsign 2 Unified Secops, Unified Secops Platform 2025-07-10 N/A
Logsign Unified SecOps Platform Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the implementation of the HTTP API. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24168.
CVE-2024-5721 1 Logsign 2 Unified Secops, Unified Secops Platform 2025-07-10 8.1 High
Logsign Unified SecOps Platform Missing Authentication Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the cluster HTTP API, which listens on TCP port 1924 when enabled. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24169.
CVE-2024-5722 1 Logsign 2 Unified Secops, Unified Secops Platform 2025-07-10 N/A
Logsign Unified SecOps Platform HTTP API Hard-coded Cryptographic Key Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Logsign Unified SecOps Platform. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HTTP API. The issue results from using a hard-coded cryptographic key. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-24170.
CVE-2024-7620 2 Fastlinemedia, The Beaver Builder Team 2 Customizer Export\/import, Cutomizer Export\/import 2025-07-10 6.6 Medium
The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created.
CVE-2025-53355 2025-07-10 7.5 High
MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. A command injection vulnerability exists in the mcp-server-kubernetes MCP Server. The vulnerability is caused by the unsanitized use of input parameters within a call to child_process.execSync, enabling an attacker to inject arbitrary system commands. Successful exploitation can lead to remote code execution under the server process's privileges. This vulnerability is fixed in 2.5.0.
CVE-2024-27905 2 Apache, Apache Software Foundation 2 Aurora, Apache Aurora 2025-07-10 9.1 Critical
** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to unauthenticated users can be used as a "padding oracle" allowing an anonymous attacker to construct a valid authentication cookie. Potentially this could be combined with vulnerabilities in other components to achieve remote code execution. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.