Export limit exceeded: 371834 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (7091 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-48908 | 2026-04-15 | N/A | ||
| lychee link checking action checks links in Markdown, HTML, and text files using lychee. Prior to version 2.0.2, there is a potential attack of arbitrary code injection vulnerability in lychee-setup of the composite action at action.yml. This issue has been patched in version 2.0.2. | ||||
| CVE-2025-30055 | 1 Cgm | 1 Clininet | 2026-04-15 | N/A |
| The "system" function receives untrusted input from the user. If the "EnableJSCaching" option is enabled, it is possible to execute arbitrary code provided as the "Module" parameter. | ||||
| CVE-2025-30056 | 1 Cgm | 1 Clininet | 2026-04-15 | N/A |
| The RunCommand function accepts any parameter, which is then passed for execution in the shell. This allows an attacker to execute arbitrary code on the system. | ||||
| CVE-2025-30057 | 1 Cgm | 1 Clininet | 2026-04-15 | N/A |
| In UHCRTFDoc, the filename parameter can be exploited to execute arbitrary code via command injection into the system() call in the ConvertToPDF function. | ||||
| CVE-2024-48818 | 2026-04-15 | 9.8 Critical | ||
| An issue in IIT Bombay, Mumbai, India Bodhitree of cs101 version allows a remote attacker to execute arbitrary code. | ||||
| CVE-2024-48694 | 1 Xian Daxi Information Technology | 1 Officeweb 365 | 2026-04-15 | 9.8 Critical |
| File Upload vulnerability in Xi'an Daxi Information technology OfficeWeb365 v.8.6.1.0 and v7.18.23.0 allows a remote attacker to execute arbitrary code via the pw/savedraw component. | ||||
| CVE-2024-48514 | 1 Maestroerror | 1 Php-heic-to-jpg | 2026-04-15 | 9.8 Critical |
| php-heic-to-jpg <= 1.0.5 is vulnerable to code injection (fixed in 1.0.6). An attacker who can upload heic images is able to execute code on the remote server via the file name. As a result, the CIA is no longer guaranteed. This affects php-heic-to-jpg 1.0.5 and below. | ||||
| CVE-2024-48453 | 2026-04-15 | 9.8 Critical | ||
| An issue in INOVANCE AM401_CPU1608TPTN allows a remote attacker to execute arbitrary code via the ExecuteUserProgramUpgrade function | ||||
| CVE-2024-48204 | 1 Hanzhou Haboo | 1 Network Management System | 2026-04-15 | 9.8 Critical |
| SQL injection vulnerability in Hanzhou Haobo network management system 1.0 allows a remote attacker to execute arbitrary code via a crafted script. | ||||
| CVE-2024-48138 | 1 Pluxml | 1 Pluxml | 2026-04-15 | 9.8 Critical |
| A remote code execution (RCE) vulnerability in the component /PluXml/core/admin/parametres_edittpl.php of PluXml v5.8.16 and lower allows attackers to execute arbitrary code via injecting a crafted payload into a template. | ||||
| CVE-2024-46966 | 1 Google | 1 Android | 2026-04-15 | 8.1 High |
| The Ikhgur mn.ikhgur.khotoch (aka Video Downloader Pro & Browser) application through 1.0.42 for Android allows an attacker to execute arbitrary JavaScript code via the mn.ikhgur.khotoch.MainActivity component. | ||||
| CVE-2024-46965 | 1 Google | 1 Ds Allvideo.downloader.browser Application For Android | 2026-04-15 | 5.4 Medium |
| The DS allvideo.downloader.browser (aka Fast Video Downloader: Browser) application through 1.6-RC1 for Android allows an attacker to execute arbitrary JavaScript code via the allvideo.downloader.browser.DefaultBrowserActivity component. | ||||
| CVE-2024-46964 | 1 Google | 1 Android | 2026-04-15 | 8.1 High |
| The com.video.downloader.all (aka All Video Downloader) application through 11.28 for Android allows an attacker to execute arbitrary JavaScript code via the com.video.downloader.all.StartActivity component. | ||||
| CVE-2024-46963 | 1 Google | 1 Android | 2026-04-15 | 8.1 High |
| The com.superfast.video.downloader (aka Super Unlimited Video Downloader - All in One) application through 5.1.9 for Android allows an attacker to execute arbitrary JavaScript code via the com.bluesky.browser.ui.BrowserMainActivity component. | ||||
| CVE-2024-46961 | 1 Inshot.com | 1 X Downloader | 2026-04-15 | 8.1 High |
| The Inshot com.downloader.privatebrowser (aka Video Downloader - XDownloader) application through 1.3.5 for Android allows an attacker to execute arbitrary JavaScript code via the com.downloader.privatebrowser.activity.PrivateMainActivity component. | ||||
| CVE-2024-46960 | 1 Asdcom | 1 Hd Video Downloader | 2026-04-15 | 8.8 High |
| The ASD com.rocks.video.downloader (aka HD Video Downloader All Format) application through 7.0.129 for Android allows an attacker to execute arbitrary JavaScript code via the com.rocks.video.downloader.MainBrowserActivity component. | ||||
| CVE-2024-46962 | 1 Google | 1 Android | 2026-04-15 | 9.1 Critical |
| The SYQ com.downloader.video.fast (aka Master Video Downloader) application through 2.0 for Android allows an attacker to execute arbitrary JavaScript code via the com.downloader.video.fast.SpeedMainAct component. | ||||
| CVE-2024-46639 | 1 Evolutionscript | 1 Helpdeskz | 2026-04-15 | 7.6 High |
| A cross-site scripting (XSS) vulnerability in HelpDeskZ v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box. | ||||
| CVE-2024-4662 | 2 Soflyy, Wordpress | 2 Oxygen, Wordpress | 2026-04-15 | 8.8 High |
| The Oxygen Builder plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.8.2 via post metadata. This is due to the plugin storing custom data in post metadata without an underscore prefix. This makes it possible for lower privileged users, such as contributors, to inject arbitrary PHP code via the WordPress user interface and gain elevated privileges. | ||||
| CVE-2021-41527 | 2026-04-15 | N/A | ||
| An error related to the 2-factor authorization (2FA) on the RISC Platform prior to the saas-2021-12-29 release can potentially be exploited to bypass the 2FA. The vulnerability requires that the 2FA setup hasn’t been completed. | ||||