CVE-2014-9195 | CRITICAL | 10.0 | 0.80689 | 68.24 | No | No | 2015-01-17 | 2025-09-05 | euvd | Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protoc…Phoenix Contact ProConOs and MultiProg do not require authentication, which allows remote attackers to execute arbitrary commands via protocol-compliant traffic. |
CVE-2023-40498 | CRITICAL | 9.8 | 0.82964 | 68.24 | No | No | 2024-05-03 | 2024-09-18 | euvd | LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a…LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the cp command implemented in the makeDetailContent method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
. Was ZDI-CAN-19925. |
CVE-2023-32435 | HIGH | 8.8 | 0.22951 | 68.23 | Yes | No | 2023-06-23 | 2025-10-21 | cisa.gov, euvd | A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and…A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4 and iPadOS 16.4, iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7. |
CVE-2022-20703 | CRITICAL | 10.0 | 0.09203 | 68.22 | Yes | No | 2022-02-10 | 2025-10-21 | cisa.gov, euvd | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the foll…Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory. |
CVE-2024-20419 | CRITICAL | 10.0 | 0.80635 | 68.22 | No | No | 2024-07-17 | 2025-02-13 | euvd | A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote at…A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users.
This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user. |
CVE-2018-12464 | CRITICAL | 10.0 | 0.80539 | 68.19 | No | No | 2018-06-29 | 2024-09-17 | euvd | A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthen…A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an administrative account and used in conjunction with CVE-2018-12465 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that use the GWAVA product name (i.e. GWAVA 6.5). |
CVE-2019-1619 | CRITICAL | 9.8 | 0.82815 | 68.19 | No | No | 2019-06-27 | 2024-11-19 | euvd | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote att…A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. The vulnerability is due to improper session management on affected DCNM software. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to gain administrative access on the affected device. |
CVE-2021-27103 | CRITICAL | 9.8 | 0.11315 | 68.16 | Yes | No | 2021-02-16 | 2025-10-21 | cisa.gov, euvd | Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 …Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later. |
CVE-2025-14174 | HIGH | 8.8 | 0.22721 | 68.15 | Yes | No | 2025-12-12 | 2026-02-26 | cisa.gov, euvd | Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memo…Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) |
CVE-2022-1292 | CRITICAL | 9.8 | 0.82612 | 68.11 | No | No | 2022-05-03 | 2025-12-30 | euvd | The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operati…The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd). |
CVE-2023-4634 | CRITICAL | 9.8 | 0.82585 | 68.1 | No | No | 2023-09-06 | 2026-04-08 | euvd | The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and incl…The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. This is due to insufficient controls on file paths being supplied to the 'mla_stream_file' parameter from the ~/includes/mla-stream-image.php file, where images are processed via Imagick(). This makes it possible for unauthenticated attackers to supply files via FTP that will make directory lists, local file inclusion, and remote code execution possible. |
CVE-2022-1471 | HIGH | 8.3 | 0.99569 | 68.05 | No | No | 2022-12-01 | 2025-06-18 | euvd | SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provide…SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker can lead to remote code execution. We recommend using SnakeYaml's SafeConsturctor when parsing untrusted content to restrict deserialization. We recommend upgrading to version 2.0 and beyond. |
CVE-2014-0546 | HIGH | 8.8 | 0.2233 | 68.02 | Yes | No | 2014-08-12 | 2025-11-21 | cisa.gov, euvd | Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, an…Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and consequently execute native code in a privileged context, via unspecified vectors. |
CVE-2021-22899 | HIGH | 8.8 | 0.22343 | 68.02 | Yes | No | 2021-05-27 | 2025-10-21 | cisa.gov, euvd | A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote co…A command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote code execution via Windows Resource Profiles Feature |
CVE-2022-20705 | CRITICAL | 10.0 | 0.80031 | 68.01 | No | No | 2022-02-10 | 2024-11-06 | euvd | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the foll…Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned software Cause denial of service (DoS) For more information about these vulnerabilities, see the Details section of this advisory. |
CVE-2023-21716 | CRITICAL | 9.8 | 0.82302 | 68.01 | No | No | 2023-02-14 | 2025-02-28 | euvd | Microsoft Word Remote Code Execution VulnerabilityMicrosoft Word Remote Code Execution Vulnerability |
CVE-2024-40890 | HIGH | 8.8 | 0.22251 | 67.99 | Yes | No | 2025-02-04 | 2025-10-21 | cisa.gov, euvd | **UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B…**UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device by sending a crafted HTTP POST request. |
CVE-2023-28206 | HIGH | 8.6 | 0.24513 | 67.98 | Yes | No | 2023-04-10 | 2025-10-21 | cisa.gov, euvd | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPad…An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.6.5, iOS 16.4.1 and iPadOS 16.4.1, macOS Ventura 13.3.1, iOS 15.7.5 and iPadOS 15.7.5, macOS Big Sur 11.7.6. An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited. |
CVE-2024-44000 | CRITICAL | 9.8 | 0.82143 | 67.95 | No | No | 2024-10-20 | 2026-04-28 | euvd | Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.Th…Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue affects LiteSpeed Cache: from n/a through < 6.5.0.1. |
CVE-2020-15069 | CRITICAL | 9.8 | 0.10674 | 67.94 | Yes | No | 2020-06-29 | 2025-10-21 | cisa.gov, euvd | Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientles…Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x. |
CVE-2026-2441 | HIGH | 8.8 | 0.2202 | 67.91 | Yes | No | 2026-02-13 | 2026-02-26 | cisa.gov, euvd | Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra…Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
CVE-2023-1698 | CRITICAL | 9.8 | 0.82037 | 67.91 | No | No | 2023-05-15 | 2025-01-23 | euvd | In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configurat…In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise. |
CVE-2024-45507 | HIGH | 8.8 | 0.93382 | 67.88 | No | No | 2024-09-04 | 2024-09-13 | euvd | Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.
This issue aff…Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.
This issue affects Apache OFBiz: before 18.12.16.
Users are recommended to upgrade to version 18.12.16, which fixes the issue. |
CVE-2024-40891 | HIGH | 8.8 | 0.21829 | 67.84 | Yes | No | 2025-02-04 | 2025-10-21 | cisa.gov, euvd | **UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel V…**UNSUPPORTED WHEN ASSIGNED**
A post-authentication command injection vulnerability in the management commands of the legacy DSL CPE Zyxel VMG4325-B10A firmware version 1.00(AAFR.4)C0_20170615 could allow an authenticated attacker to execute operating system (OS) commands on an affected device via Telnet. |
CVE-2020-17132 | CRITICAL | 9.1 | 0.8979 | 67.83 | No | No | 2020-12-09 | 2026-06-09 | euvd | Microsoft Exchange Remote Code Execution VulnerabilityMicrosoft Exchange Remote Code Execution Vulnerability |
CVE-2026-43284 | HIGH | 8.8 | 0.93235 | 67.83 | No | Yes | 2026-05-08 | 2026-08-05 | cnvd, euvd, github, packetstorm | In the Linux kernel, the following vulnerability has been resolved:
xfrm: esp: avoid in-place decrypt on shared skb frags
MSG_SPLICE_PAGES…In the Linux kernel, the following vulnerability has been resolved:
xfrm: esp: avoid in-place decrypt on shared skb frags
MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP
marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),
so later paths that may modify packet data can first make a private
copy. The IPv4/IPv6 datagram append paths did not set this flag when
splicing pages into UDP skbs.
That leaves an ESP-in-UDP packet made from shared pipe pages looking
like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW
fast path for uncloned skbs without a frag_list and decrypts in place
over data that is not owned privately by the skb.
Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching
TCP. Also make ESP input fall back to skb_cow_data() when the flag is
present, so ESP does not decrypt externally backed frags in place.
Private nonlinear skb frags still use the existing fast path.
This intentionally does not change ESP output. In esp_output_head(),
the path that appends the ESP trailer to existing skb tailroom without
calling skb_cow_data() is not reachable for nonlinear skbs:
skb_tailroom() returns zero when skb->data_len is nonzero, while ESP
tailen is positive. Thus ESP output will either use the separate
destination-frag path or fall back to skb_cow_data(). |
CVE-2019-1297 | HIGH | 8.8 | 0.21805 | 67.83 | Yes | No | 2019-09-11 | 2025-10-21 | cisa.gov, euvd | A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka '…A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory, aka 'Microsoft Excel Remote Code Execution Vulnerability'. |
CVE-2024-10924 | CRITICAL | 9.8 | 0.81722 | 67.8 | No | No | 2024-11-15 | 2026-01-23 | euvd | The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to…The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1. This is due to improper user check error handling in the two-factor REST API actions with the 'check_login_and_get_user' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, when the "Two-Factor Authentication" setting is enabled (disabled by default). |
CVE-2019-0903 | HIGH | 8.8 | 0.21713 | 67.8 | Yes | No | 2019-05-16 | 2025-10-21 | cisa.gov, euvd | A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka …A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'. |
CVE-2023-38096 | CRITICAL | 9.8 | 0.81545 | 67.74 | No | No | 2024-05-03 | 2024-09-18 | euvd | NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability. This vulnerability allows remote attacke…NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of NETGEAR ProSAFE Network Management System. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the MyHandlerInterceptor class. The issue results from improper implementation of the authentication mechanism. An attacker can leverage this vulnerability to bypass authentication on the system.
. Was ZDI-CAN-19718. |
CVE-2024-6047 | CRITICAL | 9.8 | 0.10072 | 67.73 | Yes | No | 2024-06-17 | 2025-10-21 | cisa.gov, euvd | Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploi…Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vulnerability to inject and execute arbitrary system commands on the device. |
CVE-2017-6742 | HIGH | 8.8 | 0.21424 | 67.7 | Yes | No | 2017-07-17 | 2026-01-12 | cisa.gov, euvd | A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to r…A vulnerability in the SNMP implementation of could allow an authenticated, remote attacker to cause a reload of the affected system or to remotely execute code. An attacker could exploit this vulnerability by sending a crafted SNMP packet to the affected device.
The vulnerability is due to a buffer overflow in the affected code area. The vulnerability affects all versions of SNMP (versions 1, 2c, and 3). The attacker must know the SNMP read only community string (SNMP version 2c or earlier) or the user credentials (SNMPv3). An exploit could allow the attacker to execute arbitrary code and obtain full control of the system or to cause a reload of the affected system.
Only traffic directed to the affected system can be used to exploit this vulnerability. |
CVE-2021-2456 | CRITICAL | 9.8 | 0.81366 | 67.68 | No | No | 2021-07-20 | 2024-09-25 | euvd | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General).…Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). |
CVE-2020-9377 | HIGH | 8.8 | 0.21338 | 67.67 | Yes | No | 2020-07-09 | 2025-10-21 | cisa.gov, euvd | D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products t…D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer |
CVE-2022-30690 | CRITICAL | 9.6 | 0.83583 | 67.65 | No | No | 2022-08-22 | 2025-04-15 | euvd | A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specia…A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability. |
CVE-2024-2054 | CRITICAL | 9.8 | 0.8126 | 67.64 | No | No | 2024-03-05 | 2025-02-13 | euvd | The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently en…The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. |
CVE-2022-1329 | HIGH | 8.8 | 0.92658 | 67.63 | No | No | 2022-04-19 | 2025-02-07 | euvd | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capabili…The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2. |
CVE-2012-5054 | HIGH | 8.8 | 0.21194 | 67.62 | Yes | No | 2012-09-24 | 2025-10-22 | cisa.gov, euvd | Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to exec…Integer overflow in the copyRawDataTo method in the Matrix3D class in Adobe Flash Player before 11.4.402.265 allows remote attackers to execute arbitrary code via malformed arguments. |
CVE-2024-57726 | CRITICAL | 9.9 | 0.08632 | 67.62 | Yes | No | 2025-01-15 | 2026-08-04 | cisa.gov, euvd | SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with exce…SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be used to escalate privileges to the server admin role. |
CVE-2013-0641 | HIGH | 7.8 | 0.32449 | 67.56 | Yes | No | 2013-02-14 | 2025-10-22 | cisa.gov, euvd | Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute…Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013. |
CVE-2022-31704 | CRITICAL | 9.8 | 0.81011 | 67.55 | No | No | 2023-01-25 | 2025-04-02 | euvd | The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into se…The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution. |
CVE-2025-21298 | CRITICAL | 9.8 | 0.80912 | 67.52 | No | No | 2025-01-14 | 2026-06-09 | euvd | Windows OLE Remote Code Execution VulnerabilityWindows OLE Remote Code Execution Vulnerability |
CVE-2021-37973 | CRITICAL | 9.6 | 0.11735 | 67.51 | Yes | No | 2021-10-08 | 2025-10-21 | cisa.gov, euvd | Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to poten…Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. |
CVE-2024-0692 | HIGH | 8.8 | 0.92245 | 67.49 | No | No | 2024-03-01 | 2025-04-16 | euvd | The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated u…The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. This vulnerability allows an unauthenticated user to abuse SolarWinds’ service, resulting in remote code execution. |
CVE-2022-0609 | HIGH | 8.8 | 0.20767 | 67.47 | Yes | No | 2022-04-04 | 2025-10-21 | cisa.gov, euvd | Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a c…Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2020-24363 | HIGH | 8.8 | 0.20689 | 67.44 | Yes | No | 2020-08-31 | 2025-10-21 | cisa.gov, euvd | TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request …TP-Link TL-WA855RE V5 20200415-rel37464 devices allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. |
CVE-2024-2876 | CRITICAL | 9.8 | 0.80596 | 67.41 | No | No | 2024-05-02 | 2026-04-08 | euvd | The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vuln…The Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IG_ES_Subscribers_Query' class in all versions up to, and including, 5.7.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
CVE-2022-0185 | HIGH | 8.4 | 0.25151 | 67.4 | Yes | No | 2022-02-11 | 2025-10-21 | cisa.gov, euvd | A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux …A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system. |
CVE-2024-7971 | HIGH | 8.8 | 0.20547 | 67.39 | Yes | No | 2024-08-21 | 2025-10-21 | cisa.gov, euvd | Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (…Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
CVE-2021-42292 | HIGH | 7.8 | 0.31949 | 67.38 | Yes | No | 2021-11-10 | 2025-10-21 | cisa.gov, euvd | Microsoft Excel Security Feature Bypass VulnerabilityMicrosoft Excel Security Feature Bypass Vulnerability |