Export limit exceeded: 13878 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 10103 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10103 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2024-35272 1 Microsoft 8 Sql Server, Sql Server 2016, Sql Server 2017 and 5 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-35271 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-38086 1 Microsoft 2 Azure Kinect Sdk, Azure Kinect Software Development Kit 2025-12-09 6.4 Medium
Azure Kinect SDK Remote Code Execution Vulnerability
CVE-2024-37331 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-37332 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-37318 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21428 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21415 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21414 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21398 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21373 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21335 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21333 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-21332 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-38087 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2024-38088 1 Microsoft 5 Sql Server, Sql Server 2016, Sql Server 2017 and 2 more 2025-12-09 8.8 High
SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability
CVE-2025-12966 2 Plugins360, Wordpress 2 All-in-one Video Gallery, Wordpress 2025-12-08 8.8 High
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the resolve_import_directory() function in versions 4.5.4 to 4.5.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2025-13426 1 Google 1 Cloud Apigee 2025-12-08 N/A
A vulnerability exists in Google Apigee's JavaCallout policy https://docs.apigee.com/api-platform/reference/policies/java-callout-policy that allows for remote code execution. It is possible for a user to write a JavaCallout that injected a malicious object into the MessageContext to execute arbitrary Java code and system commands at runtime, leading to unauthorized access to data, lateral movement within the network, and access to backend systems. The Apigee hybrid versions below have all been updated to protect from this vulnerability: * Hybrid_1.11.2+ * Hybrid_1.12.4+ * Hybrid_1.13.3+ * Hybrid_1.14.1+ * OPDK_5202+ * OPDK_5300+
CVE-2020-36879 2 Flexense, Flexsense 2 Diskboss, Diskboss 2025-12-08 N/A
Flexsense DiskBoss 11.7.28 allows unauthenticated attackers to elevate their privileges using any of its services, enabling remote code execution during startup or reboot with escalated privileges. Attackers can exploit the unquoted service path vulnerability by specifying a malicious service name in the 'sc qc' command, allowing them to execute arbitrary system commands.
CVE-2025-52572 1 Hikariatama 1 Hikka 2025-12-08 10 Critical
Hikka, a Telegram userbot, has vulnerability affects all users on all versions of Hikka. Two scenarios are possible. 1. Web interface does not have an authenticated session: attacker can use his own Telegram account to gain RCE to the server by authorizing in the dangling web interface. 2. Web interface does have an authenticated session: due to insufficient warning in the authentication message, users were tempted to click "Allow" in the "Allow web application ops" menu. This gave an attacker access not only to remote code execution, but also to Telegram accounts of owners. Scenario number 2 is known to have been exploited in the wild. No known patches are available, but some workarounds are available. Use `--no-web` flag and do not start userbot without it; after authorizing in the web interface, close the port on the server and/or start the userbot with `--no-web` flag; and do not click "Allow" in your helper bot unless it is your explicit action that needs to be allowed.