Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (413228 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2024-39173 1 253153 1 Calculator-boilerplate 2026-04-15 9.8 Critical
calculator-boilerplate v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the eval function at /routes/calculator.js. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the input field.
CVE-2024-39178 1 Maipu 1 Mypower Vc8100 2026-04-15 5.4 Medium
MyPower vc8100 V100R001C00B030 was discovered to contain an arbitrary file read vulnerability via the component /tcpdump/tcpdump.php?menu_uuid.
CVE-2024-39182 1 Ispmanager 1 Ispmanager 2026-04-15 7.5 High
An information disclosure vulnerability in ISPmanager v6.98.0 allows attackers to access sensitive details of the root user's session via an arbitrary command (ISP6-1779).
CVE-2024-39205 1 Pyload-ng Project 1 Pyload-ng 2026-04-15 9.8 Critical
An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request.
CVE-2024-39206 1 Msp360 1 Backup Agent 2026-04-15 7.5 High
An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup due to enginesettings.list being encrypted with a hard coded key.
CVE-2024-39207 2026-04-15 8.2 High
lua-shmem v1.0-1 was discovered to contain a buffer overflow via the shmem_write function.
CVE-2024-39208 1 Luciapplucky 1 Luci-app-lucky 2026-04-15 9.8 Critical
luci-app-lucky v2.8.3 was discovered to contain hardcoded credentials.
CVE-2024-39209 1 Luci App Sms Tool 1 Luci App Sms Tool 2026-04-15 6.3 Medium
luci-app-sms-tool v1.9-6 was discovered to contain a command injection vulnerability via the score parameter.
CVE-2024-39211 1 Kaiten 1 Kaiten 2026-04-15 5.3 Medium
Kaiten 57.128.8 allows remote attackers to enumerate user accounts via a crafted POST request, because a login response contains a user_email field only if the user account exists.
CVE-2024-39220 1 Bas-ip 29 Aa-07bd, Aa-07bdi, Av-01bd and 26 more 2026-04-15 6.5 Medium
BAS-IP AV-01D, AV-01MD, AV-01MFD, AV-01ED, AV-01KD, AV-01BD, AV-01KBD, AV-02D, AV-02IDE, AV-02IDR, AV-02IPD, AV-02FDE, AV-02FDR, AV-03D, AV-03BD, AV-04AFD, AV-04ASD, AV-04FD, AV-04SD, AV-05FD, AV-05SD, AA-07BD, AA-07BDI, BA-04BD, BA-04MD, BA-08BD, BA-08MD, BA-12BD, BA-12MD, CR-02BD before firmware v3.9.2 allows authenticated attackers to read SIP account passwords via a crafted GET request.
CVE-2024-39223 1 Ginuerzh 1 Gost 2026-04-15 9.8 Critical
An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey
CVE-2024-37996 2026-04-15 3.3 Low
A vulnerability has been identified in JT Open (All versions < V11.5), JT2Go (All versions < V2406.0003), PLM XML SDK (All versions < V7.1.0.014), Teamcenter Visualization V14.2 (All versions < V14.2.0.13), Teamcenter Visualization V14.3 (All versions < V14.3.0.11), Teamcenter Visualization V2312 (All versions < V2312.0008), Teamcenter Visualization V2406 (All versions < V2406.0003). The affected applications contain a null pointer dereference vulnerability while parsing specially crafted XML files. An attacker could leverage this vulnerability to crash the application causing denial of service condition.
CVE-2024-3799 2026-04-15 N/A
Insecure handling of POST header parameter body included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create a website, which – when visited by a user – will send malicious requests to multiple hosts on the local network. If such a request reaches the server, it will cause a shell command execution. This issue affects Phoniebox in all releases through 2.7. Newer 2.x releases were not tested, but they might also be vulnerable. Phoniebox in version 3.0 and higher are not affected.
CVE-2024-36558 2026-04-15 7.5 High
Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h suffers from Cleartext Transmission of Sensitive Information due to lack of encryption in device-server communication.
CVE-2024-3657 1 Redhat 5 Directory Server, Directory Server E4s, Directory Server Eus and 2 more 2026-04-15 7.5 High
A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service
CVE-2024-36573 1 Almela 1 Obx 2026-04-15 9.8 Critical
almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@almela/obx/build/index.js:470), Object.set (obx/build/index.js:269) component.
CVE-2024-36574 1 Amirziai 1 Flatten Json 2026-04-15 6.3 Medium
A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-json/index.js:42)
CVE-2024-36575 1 Notabotai 1 Getsetprop 2026-04-15 9.8 Critical
A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor.
CVE-2024-36577 1 Apphp 1 Apphp Js-object-resolver 2026-04-15 8.3 High
apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty.
CVE-2024-36578 1 Akbr 1 Update 2026-04-15 5.9 Medium
akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js.