Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10036 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2019-1163 1 Microsoft 9 Windows 10, Windows 10 1507, Windows 10 1607 and 6 more 2026-02-20 5.5 Medium
A security feature bypass exists when Windows incorrectly validates CAB file signatures. An attacker who successfully exploited this vulnerability could inject code into a CAB file without invalidating the file's signature. To exploit the vulnerability, an attacker could modify a signed CAB file and inject malicious code. The attacker could then convince a target user to execute the file. The update addresses the vulnerability by correcting how Windows validates file signatures.
CVE-2024-55089 1 Rhymix 1 Rhymix 2026-02-20 4.1 Medium
Rhymix before 2.1.24 is vulnerable to Server-Side Request Forgery (SSRF) in the background import data function because XML documents may contain external entities.
CVE-2025-13333 1 Ibm 1 Websphere Application Server 2026-02-20 4.4 Medium
IBM WebSphere Application Server 9.0, and 8.5 could provide weaker than expected security during system administration of security settings.
CVE-2020-37158 2 Avideo, Wwbn 2 Avideo Platform, Avideo 2026-02-20 5.3 Medium
AVideo Platform 8.1 contains a cross-site request forgery vulnerability that allows attackers to reset user passwords by exploiting the password recovery mechanism. Attackers can craft malicious requests to the recoverPass endpoint using the user's recovery token to change account credentials without authentication.
CVE-2025-49715 1 Microsoft 2 Dynamics 365, Dynamics 365 Fasttrack Implementation 2026-02-20 7.5 High
Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network.
CVE-2025-47967 2 Google, Microsoft 3 Android, Edge, Edge Chromium 2026-02-20 4.7 Medium
Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-13982 2 Drupal, Innoraft 2 Login Time Restriction, Login Time Restriction 2026-02-19 8.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: from 0.0.0 before 1.0.3.
CVE-2023-41970 1 Zscaler 1 Client Connector 2026-02-19 6 Medium
An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on Windows during the Repair App functionality may allow Local Execution of Code.This issue affects Client Connector on Windows: before 4.1.0.62.
CVE-2018-17366 1 Mingsoft 1 Mcms 2026-02-19 N/A
An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do.
CVE-2020-37173 2 Avideo, Wwbn 2 Avideo Platform, Avideo 2026-02-18 7.5 High
AVideo Platform 8.1 contains an information disclosure vulnerability that allows attackers to enumerate user details through the playlistsFromUser.json.php endpoint. Attackers can retrieve sensitive user information including email, password hash, and administrative status by manipulating the users_id parameter.
CVE-2024-23462 1 Zscaler 1 Client Connector 2026-02-17 3.3 Low
An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary and thus removing client functionality.This issue affects Client Connector on MacOS: before 3.4.
CVE-2024-23461 1 Zscaler 1 Client Connector 2026-02-17 4.2 Medium
An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS during the upgrade process may allow a Local Execution of Code.This issue affects Client Connector on MacOS: before 3.4.
CVE-2022-0088 1 Yourls 1 Yourls 2026-02-16 7.4 High
Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.
CVE-2025-21193 1 Microsoft 6 Windows Server 2016, Windows Server 2019, Windows Server 2022 and 3 more 2026-02-13 6.5 Medium
Active Directory Federation Server Spoofing Vulnerability
CVE-2025-21267 1 Microsoft 1 Edge Chromium 2026-02-13 4.4 Medium
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2025-48803 1 Microsoft 19 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 16 more 2026-02-13 6.7 Medium
Missing support for integrity check in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
CVE-2025-33054 1 Microsoft 7 Windows 11 22h2, Windows 11 22h2, Windows 11 23h2 and 4 more 2026-02-13 8.1 High
Insufficient UI warning of dangerous operations in Remote Desktop Client allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-53765 1 Microsoft 2 Azure App Service On Azure Stack, Azure Stack Hub 2026-02-13 4.4 Medium
Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally.
CVE-2025-59891 1 Flexense 4 Disk Pulse Enterprise, Diskpulse, Sync Breeze Enterprise Server and 1 more 2026-02-10 8.0 High
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to change a user's password or create users via '/setup_login?sid=', affecting the 'username', 'password', and 'cpassword' parameters.
CVE-2025-59892 1 Flexense 4 Disk Pulse Enterprise, Diskpulse, Sync Breeze Enterprise Server and 1 more 2026-02-10 8.0 High
Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause another user to perform unwanted actions within the application they are logged into. This vulnerability is possible due to the lack of proper CSRF token implementation. Among other things, it is possible, using a POST request to delete commands individually via '/delete_command?sid=', using the 'cid' parameter.