Export limit exceeded: 371194 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (7073 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2022-2143 1 Advantech 1 Iview 2025-04-16 9.8 Critical
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.
CVE-2024-0817 1 Paddlepaddle 1 Paddlepaddle 2025-04-16 7.8 High
Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0
CVE-2020-15685 2 Mozilla, Redhat 3 Thunderbird, Enterprise Linux, Rhel Eus 2025-04-16 8.8 High
During the plaintext phase of the STARTTLS connection setup, protocol commands could have been injected and evaluated within the encrypted session. This vulnerability affects Thunderbird < 78.7.
CVE-2024-57228 1 Linksys 2 E7350, E7350 Firmware 2025-04-16 8 High
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.
CVE-2024-57227 1 Linksys 2 E7350, E7350 Firmware 2025-04-16 8 High
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.
CVE-2024-57226 1 Linksys 2 E7350, E7350 Firmware 2025-04-16 8 High
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif_enable function.
CVE-2022-31740 2 Mozilla, Redhat 6 Firefox, Firefox Esr, Thunderbird and 3 more 2025-04-16 8.8 High
On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
CVE-2024-57225 1 Linksys 2 E7350, E7350 Firmware 2025-04-16 9.8 Critical
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.
CVE-2024-57224 1 Linksys 2 E7350, E7350 Firmware 2025-04-16 9.8 Critical
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function.
CVE-2024-57223 1 Linksys 2 E7350, E7350 Firmware 2025-04-16 9.8 Critical
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode function.
CVE-2024-57222 1 Linksys 2 E7350, E7350 Firmware 2025-04-16 6.3 Medium
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function.
CVE-2022-26007 1 Inhandnetworks 2 Ir302, Ir302 Firmware 2025-04-15 7.2 High
An OS command injection vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVE-2022-26042 1 Inhandnetworks 2 Ir302, Ir302 Firmware 2025-04-15 8.8 High
An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVE-2022-26085 1 Inhandnetworks 2 Ir302, Ir302 Firmware 2025-04-15 8.8 High
An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2022-29503 3 Anker, Uclibc, Uclibc-ng Project 4 Eufy Homebase 2, Eufy Homebase 2 Firmware, Uclibc and 1 more 2025-04-15 9.8 Critical
A memory corruption vulnerability exists in the libpthread linuxthreads functionality of uClibC 0.9.33.2 and uClibC-ng 1.0.40. Thread allocation can lead to memory corruption. An attacker can create threads to trigger this vulnerability.
CVE-2022-32765 1 Robustel 2 R1510, R1510 Firmware 2025-04-15 9.8 Critical
An OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.
CVE-2022-35265 1 Robustel 2 R1510, R1510 Firmware 2025-04-15 7.5 High
A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_nodejs_app/` API.
CVE-2022-35266 1 Robustel 2 R1510, R1510 Firmware 2025-04-15 7.5 High
A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_firmware/` API.
CVE-2022-35267 1 Robustel 2 R1510, R1510 Firmware 2025-04-15 7.5 High
A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_https_cert_file/` API.
CVE-2022-35269 1 Robustel 2 R1510, R1510 Firmware 2025-04-15 7.5 High
A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_e2c_json_file/` API.