Export limit exceeded: 413273 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (122 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-66486 1 Ibm 1 Aspera Shares 2026-04-07 4.8 Medium
IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVE-2025-66487 1 Ibm 1 Aspera Shares 2026-04-07 2.7 Low
IBM Aspera Shares 1.9.9 through 1.11.0 does not properly rate limit the frequency that an authenticated user can send emails, which could result in email flooding or a denial of service.
CVE-2025-13460 3 Ibm, Linux, Microsoft 3 Aspera Console, Linux Kernel, Windows 2026-03-23 5.3 Medium
IBM Aspera Console 3.3.0 through 3.4.8 could allow an attacker to enumerate usernames due to an observable response discrepancy.
CVE-2025-13459 3 Ibm, Linux, Microsoft 3 Aspera Console, Linux Kernel, Windows 2026-03-23 2.7 Low
IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow.
CVE-2025-13212 3 Ibm, Linux, Microsoft 3 Aspera Console, Linux Kernel, Windows 2026-03-23 5.3 Medium
IBM Aspera Console 3.3.0 through 3.4.8 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
CVE-2025-13219 2 Ibm, Linux 2 Aspera Orchestrator, Linux Kernel 2026-03-12 5.9 Medium
IBM Aspera Orchestrator 3.0.0 through 4.1.2 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized parties have access to the URLs via server logs, referrer header or browser history.
CVE-2025-36226 2 Ibm, Linux 3 Aspera Faspex, Aspera Faspex 5, Linux Kernel 2026-03-12 5.4 Medium
IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2025-36227 2 Ibm, Linux 3 Aspera Faspex, Aspera Faspex 5, Linux Kernel 2026-03-12 5.4 Medium
IBM Aspera Faspex 5 5.0.0 through 5.0.14.3 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers.  This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.
CVE-2025-13213 2 Ibm, Linux 2 Aspera Orchestrator, Linux Kernel 2026-03-12 5.4 Medium
IBM Aspera Orchestrator 3.0.0 through 4.1.2 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking
CVE-2025-14480 1 Ibm 1 Aspera Faspio Gateway 2026-03-05 5.1 Medium
IBM Aspera faspio Gateway 1.3.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information
CVE-2025-13379 1 Ibm 1 Aspera Console 2026-02-26 8.6 High
IBM Aspera Console 3.4.0 through 3.4.8 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
CVE-2025-13925 1 Ibm 1 Aspera Console 2026-01-30 4.9 Medium
IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged user.
CVE-2025-36228 1 Ibm 2 Aspera Faspex, Aspera Faspex 5 2025-12-29 3.8 Low
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that appeared disabled, potentially leading to misuse.
CVE-2025-36229 1 Ibm 2 Aspera Faspex, Aspera Faspex 5 2025-12-29 3.1 Low
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers.
CVE-2025-36230 1 Ibm 2 Aspera Faspex, Aspera Faspex 5 2025-12-29 5.4 Medium
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVE-2025-13148 2 Ibm, Linux 2 Aspera Orchestrator, Linux Kernel 2025-12-15 8.1 High
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password.
CVE-2025-13211 2 Ibm, Linux 2 Aspera Orchestrator, Linux Kernel 2025-12-15 5.3 Medium
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
CVE-2025-13214 2 Ibm, Linux 2 Aspera Orchestrator, Linux Kernel 2025-12-15 7.6 High
IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
CVE-2025-13481 2 Ibm, Linux 2 Aspera Orchestrator, Linux Kernel 2025-12-15 8.8 High
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
CVE-2025-36274 1 Ibm 1 Aspera Http Gateway 2025-12-11 7.5 High
IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.