Export limit exceeded: 21563 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (8199 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-14020 | 1 Carboneio | 1 Carbone | 2026-04-15 | 5 Medium |
| A weakness has been identified in carboneio carbone up to fbcd349077ad0e8748be73eab2a82ea92b6f8a7e. This impacts an unknown function of the file lib/input.js of the component Formatter Handler. Executing a manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is said to be difficult. Upgrading to version 3.5.6 will fix this issue. This patch is called 04f9feb24bfca23567706392f9ad2c53bbe4134e. You should upgrade the affected component. A successful exploitation can "only occur if the parent NodeJS application has the same security issue". | ||||
| CVE-2024-2097 | 1 Hitachienergy | 1 Modular Advanced Control For Hvdc | 2026-04-15 | 7 High |
| An authenticated malicious client can send a special LINQ query to execute arbitrary code remotely (RCE) on the SCM server from List control, and execute the arbitrary code on the same system where SCMArchivedEventViewerTool is installed in the case of SCM Tools. | ||||
| CVE-2024-21832 | 2026-04-15 | 3.5 Low | ||
| A potential JSON injection attack vector exists in PingFederate REST API data stores using the POST method and a JSON request body. | ||||
| CVE-2024-22020 | 2 Nodejs, Redhat | 2 Nodejs, Enterprise Linux | 2026-04-15 | 6.5 Medium |
| A security flaw in Node.js allows a bypass of network import restrictions. By embedding non-network imports in data URLs, an attacker can execute arbitrary code, compromising system security. Verified on various platforms, the vulnerability is mitigated by forbidding data URLs in network imports. Exploiting this flaw can violate network import security, posing a risk to developers and servers. | ||||
| CVE-2024-22632 | 1 Setor | 1 Sil | 2026-04-15 | 9.8 Critical |
| Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability via the hmsg parameter. This vulnerability is triggered via a crafted POST request. | ||||
| CVE-2024-22633 | 2026-04-15 | 9.8 Critical | ||
| Setor Informatica Sistema Inteligente para Laboratorios (S.I.L.) 388 was discovered to contain a remote code execution (RCE) vulnerability via the hprinter parameter. This vulnerability is triggered via a crafted POST request. | ||||
| CVE-2024-27627 | 1 Supercali | 1 Supercali | 2026-04-15 | 6.1 Medium |
| A reflected cross-site scripting (XSS) vulnerability exists in SuperCali version 1.1.0, allowing remote attackers to execute arbitrary JavaScript code via the email parameter in the bad_password.php page. | ||||
| CVE-2024-29276 | 1 Seeyonao | 1 Seeyonoa | 2026-04-15 | 9.8 Critical |
| An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDesignerController.class component. | ||||
| CVE-2024-29309 | 1 Alfresco | 1 Alfresco Content Services | 2026-04-15 | 7.7 High |
| An issue in Alfresco Content Services v.23.3.0.7 allows a remote attacker to execute arbitrary code via the Transfer Service. | ||||
| CVE-2024-29415 | 2 Fedorindutny, Redhat | 2 Ip, Openshift Devspaces | 2026-04-15 | 8.1 High |
| The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282. | ||||
| CVE-2024-29513 | 1 Bluerisc | 1 Windowscope | 2026-04-15 | 7.8 High |
| An issue in briscKernelDriver.sys in BlueRiSC WindowsSCOPE Cyber Forensics before 3.3 allows a local attacker to execute arbitrary code within the driver and create a local denial-of-service condition due to an improper DACL being applied to the device the driver creates. | ||||
| CVE-2024-3319 | 2026-04-15 | 9.1 Critical | ||
| An issue was identified in the Identity Security Cloud (ISC) Transform preview and IdentityProfile preview API endpoints that allowed an authenticated administrator to execute user-defined templates as part of attribute transforms which could allow remote code execution on the host. | ||||
| CVE-2024-33225 | 1 Dell | 1 Realtek High Definition Audio Driver | 2026-04-15 | 7.8 High |
| An issue in the component RTKVHD64.sys of Realtek Semiconductor Corp Realtek(r) High Definition Audio Function Driver v6.0.9549.1 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests. | ||||
| CVE-2024-33228 | 2026-04-15 | 8.4 High | ||
| An issue in the component segwindrvx64.sys of Insyde Software Corp SEG Windows Driver v100.00.07.02 allows attackers to escalate privileges and execute arbitrary code via sending crafted IOCTL requests. | ||||
| CVE-2024-34461 | 1 Tribalsystems | 1 Zenario | 2026-04-15 | 9.8 Critical |
| Zenario before 9.5.60437 uses Twig filters insecurely in the Twig Snippet plugin, and in the site-wide HEAD and BODY elements, enabling code execution by a designer or an administrator. | ||||
| CVE-2024-34761 | 2026-04-15 | 8.5 High | ||
| Vulnerability discovered by executing a planned security audit. Improper Control of Generation of Code ('Code Injection') vulnerability in WPENGINE INC Advanced Custom Fields PRO allows Code Injection.This issue affects Advanced Custom Fields PRO: from n/a before 6.2.10. | ||||
| CVE-2024-34947 | 2026-04-15 | 9.4 Critical | ||
| Quanxun Huiju Network Technology (Beijing) Co.,Ltd IK-Q3000 3.7.10 x64 Build202401261655 was discovered to be vulnerable to an ICMP redirect attack. | ||||
| CVE-2024-35226 | 1 Smarty-php | 1 Smarty | 2026-04-15 | 7.3 High |
| Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. All users are advised to update. There is no patch for users on the v3 branch. There are no known workarounds for this vulnerability. | ||||
| CVE-2024-36575 | 1 Notabotai | 1 Getsetprop | 2026-04-15 | 9.8 Critical |
| A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor. | ||||
| CVE-2024-36581 | 1 Prototype Solution | 1 Abw Badger Database | 2026-04-15 | 7.6 High |
| A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm. | ||||