Search

Expected end of text, found '.' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (340855 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-33060 1 Ondata 1 Ckan-mcp-server 2026-03-24 5.3 Medium
CKAN MCP Server is a tool for querying CKAN open data portals. Versions prior to 0.4.85 provide tools including ckan_package_search and sparql_query that accept a base_url parameter, making HTTP requests to arbitrary endpoints without restriction. A CKAN portal client has no legitimate reason to contact cloud metadata or internal network services. There is no URL validation on base_url parameter. No private IP blocking (RFC 1918, link-local 169.254.x.x), no cloud metadata blocking. The sparql_query and ckan_datastore_search_sql tools also accept arbitrary base URLs and expose injection surfaces. An attack can lead to internal network scanning, cloud metadata theft (IAM credentials via IMDS at 169.254.169.254), potential SQL/SPARQL injection via unsanitized query parameters. Attack requires prompt injection to control the base_url parameter. This issue has been fixed in version 0.4.85.
CVE-2026-32912 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-32911 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-32910 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-32909 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-32908 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-32907 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-32904 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-32903 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-32902 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-32901 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-32900 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-32066 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-32047 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-32012 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-28483 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-28455 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2026-22173 2026-03-23 N/A
This CVE ID has been rejected.
CVE-2025-52454 4 Linux, Microsoft, Salesforce and 1 more 4 Linux Kernel, Windows, Tableau Server and 1 more 2026-03-23 8.2 High
Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing. This issue affects Tableau Server: before 2025.1.3, before 2024.2.12, before 2023.3.19.
CVE-2025-51602 1 Videolan 1 Vlc Media Player 2026-03-23 4.8 Medium
mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server.