Export limit exceeded: 11766 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 11,766

Export CSV
CVE-2025-65036

XWiki Remote Macros vulnerable to remote code execution using the confluence details summary macro

XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. Prior to 1.27.1, the macro executes Velocity from the details pages without checking for permissions, which can lead to remote code execution. This vulnerability is fixed in 1.27.1.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Xwiki Xwikisas
Products
Pro Macros Xwiki-pro-macros
CVE-2025-67684

Remote Code Execution via Local File Inclusion in Quick.Cart

Quick.Cart is vulnerable to Local File Inclusion and Path Traversal issues in the theme selection mechanism. Quick.Cart allows a privileged user to upload arbitrary file contents while only validating the filename extension. This allows an attacker to include and execute uploaded PHP code, resulting in Remote Code Execution on the server. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.7 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Opensolution
Products
Quick.cart
CVE-2025-61880

In Infoblox NIOS through 9.0.7, insecure deserialization can result in remote code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Infoblox
Products
Nios
CVE-2025-68952

1-click Remote Code Execution (RCE) vulnerability in Eigent

Eigent is a multi-agent Workforce. In version 0.0.60, a 1-click Remote Code Execution (RCE) vulnerability has been identified in Eigent. This vulnerability allows an attacker to execute arbitrary code on the victim's machine or server through a specific interaction (1-click). This issue has been patched in version 0.0.61.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Eigent Eigent-ai
Products
Eigent Eigent
CVE-2021-41773

Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49

A flaw was found in a change made to path normalization in Apache HTTP Server 2.4.49. An attacker could use a path traversal attack to map URLs to files outside the directories configured by Alias-like directives. If files outside of these directories are not protected by the usual default configuration "require all denied", these requests can succeed. If CGI scripts are also enabled for these aliased pathes, this could allow for remote code execution. This issue is known to be exploited in the wild. This issue only affects Apache 2.4.49 and not earlier versions. The fix in Apache HTTP Server 2.4.50 was found to be incomplete, see CVE-2021-42013.

CVSS 3.1 · 7.5 High EPSS 100.0% KEV · Listed
Vendors
Apache Fedoraproject Netapp and 1 more
Products
Http Server Fedora Cloud Backup and 1 more
CVE-2025-20634

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01289384; Issue ID: MSV-2436.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Mediatek
Products
Mt2737 Mt6813 Mt6835 and 29 more
CVE-2024-20154

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00720348; Issue ID: MSV-2392.

CVSS 3.1 · 8.8 High EPSS 3.9% KEV · Not listed
Vendors
Mediatek
Products
Lr12a Lr13 Mt2735 and 53 more