Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (7445 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-21419 1 Microsoft 23 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 20 more 2025-12-17 7.1 High
Windows Setup Files Cleanup Elevation of Privilege Vulnerability
CVE-2025-21391 1 Microsoft 19 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 16 more 2025-12-17 7.1 High
Windows Storage Elevation of Privilege Vulnerability
CVE-2025-21188 1 Microsoft 2 Azure Network Watcher, Azure Network Watcher Agent 2025-12-17 6 Medium
Azure Network Watcher VM Extension Elevation of Privilege Vulnerability
CVE-2025-29795 1 Microsoft 2 Edge Update, Edge Update Setup 2025-12-17 7.8 High
Improper link resolution before file access ('link following') in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
CVE-2025-24984 1 Microsoft 21 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 18 more 2025-12-17 4.6 Medium
Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack.
CVE-2025-24045 1 Microsoft 8 Windows Server 2012, Windows Server 2012 R2, Windows Server 2016 and 5 more 2025-12-17 8.1 High
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVE-2025-29807 1 Microsoft 1 Dataverse 2025-12-17 8.7 High
Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network.
CVE-2025-25008 1 Microsoft 6 Windows Server 2016, Windows Server 2019, Windows Server 2022 and 3 more 2025-12-17 7.1 High
Improper link resolution before file access ('link following') in Microsoft Windows allows an authorized attacker to elevate privileges locally.
CVE-2025-24035 1 Microsoft 24 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 21 more 2025-12-17 8.1 High
Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVE-2025-43517 1 Apple 3 Macos, Macos Sequoia, Macos Sonoma 2025-12-17 3.3 Low
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Tahoe 26.2, macOS Sequoia 15.7.3, macOS Sonoma 14.8.3. An app may be able to access protected user data.
CVE-2025-43448 1 Apple 9 Ios, Ipados, Iphone Os and 6 more 2025-12-17 6.3 Medium
This issue was addressed with improved validation of symlinks. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, visionOS 26.1. An app may be able to break out of its sandbox.
CVE-2025-43446 1 Apple 3 Macos, Macos Sequoia, Macos Sonoma 2025-12-17 5.5 Medium
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1, macOS Sonoma 14.8.2. An app may be able to modify protected parts of the file system.
CVE-2025-43423 1 Apple 6 Ios, Ipad Os, Ipados and 3 more 2025-12-17 2 Low
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, iOS 18.7.2 and iPadOS 18.7.2, macOS Sequoia 15.7.2, visionOS 26.1. An attacker with physical access to an unlocked device paired with a Mac may be able to view sensitive user information in system logging.
CVE-2025-43410 1 Apple 3 Macos, Macos Sequoia, Macos Sonoma 2025-12-17 2.4 Low
The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.2, macOS Sonoma 14.8.2. An attacker with physical access may be able to view deleted notes.
CVE-2025-43395 1 Apple 3 Macos, Macos Sequoia, Macos Sonoma 2025-12-17 3.3 Low
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1, macOS Sonoma 14.8.2. An app may be able to access protected user data.
CVE-2025-43394 1 Apple 3 Macos, Macos Sequoia, Macos Sonoma 2025-12-17 5.5 Medium
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.7.2, macOS Tahoe 26.1, macOS Sonoma 14.8.2. An app may be able to access protected user data.
CVE-2025-43379 1 Apple 9 Ios, Ipados, Iphone Os and 6 more 2025-12-17 5.5 Medium
This issue was addressed with improved validation of symlinks. This issue is fixed in tvOS 26.1, watchOS 26.1, macOS Tahoe 26.1, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, visionOS 26.1. An app may be able to access protected user data.
CVE-2020-36896 2 Howfor, Qihang Media 2 Qihang Media Web Digital Signage, Web Digital Signage 2025-12-17 7.5 High
QiHang Media Web Digital Signage 3.0.9 contains a cleartext credentials vulnerability that allows unauthenticated attackers to access administrative login information through an unprotected XML file. Attackers can retrieve hardcoded admin credentials by requesting the '/xml/User/User.xml' file, enabling direct authentication bypass.
CVE-2020-36899 2 Howfor, Qihang Media 2 Qihang Media Web Digital Signage, Web Digital Signage 2025-12-17 7.5 High
QiHang Media Web Digital Signage 3.0.9 contains an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive files through unverified 'filename' and 'path' parameters. Attackers can exploit the QH.aspx endpoint to read arbitrary files and directory contents without authentication by manipulating download and getAll actions.
CVE-2025-66214 1 Wearefrank 1 Ladybug 2025-12-17 7 High
Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/ladybug/api/report/{storage} and /iaf/ladybug/api/report/upload, which allow uploading gzip-compressed XML files with user-controllable content. The system deserializes these XML files, enabling attackers to achieve Remote Code Execution (RCE) by submitting carefully crafted XML payloads and thereby gain access to the target server. This issue is fixed in version 3.0-20251107.114628.