Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9955 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-20615 1 Qardio 1 Qardio 2025-03-24 6.2 Medium
The Qardio Arm iOS application exposes sensitive data such as usernames and passwords in a plist file. This allows an attacker to log in to production-level development accounts and access an engineering backdoor in the application. The engineering backdoor allows the attacker to send hex-based commands over a UI-based terminal.
CVE-2022-4138 1 Gitlab 1 Gitlab 2025-03-21 6.4 Medium
A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a malicious project.
CVE-2022-36288 1 W3eden 1 Download Manager 2025-03-21 5.4 Medium
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.
CVE-2022-34347 1 W3eden 1 Download Manager 2025-03-21 4.2 Medium
Cross-Site Request Forgery (CSRF) vulnerability in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.
CVE-2024-41780 3 Ibm, Linux, Microsoft 3 Jazz Foundation, Linux Kernel, Windows 2025-03-21 4.2 Medium
IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could could allow a physical user to obtain sensitive information due to not masking passwords during entry.
CVE-2015-10130 1 I13websolution 2 Continuous Image Carosel With Lightbox, Team Circle Image Slider With Lightbox 2025-03-21 5.3 Medium
The Team Circle Image Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0. This is due to missing or incorrect nonce validation on the circle_thumbnail_slider_with_lightbox_image_management_func() function. This makes it possible for unauthenticated attackers to edit image data which can be used to inject malicious JavaScript, along with deleting images, and uploading malicious files via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVE-2023-22375 1 Planex 2 Cs-wmv02g, Cs-wmv02g Firmware 2025-03-20 8.8 High
Cross-site request forgery (CSRF) vulnerability in Wired/Wireless LAN Pan/Tilt Network Camera CS-WMV02G all versions allows a remote unauthenticated attacker to hijack the authentication and conduct arbitrary operations by having a logged-in user to view a malicious page. NOTE: This vulnerability only affects products that are no longer supported by the developer.
CVE-2022-29557 1 Relx 1 Firco Compliance Link 2025-03-20 8.8 High
LexisNexis Firco Compliance Link 3.7 allows CSRF.
CVE-2021-33396 1 Baijiacms Project 1 Baijiacms 2025-03-20 6.5 Medium
Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbitrary account via index.php.
CVE-2023-22689 1 Flamescorpion 1 Auto Affiliate Links 2025-03-20 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3 versions.
CVE-2023-47652 1 Flamescorpion 1 Auto Affiliate Links 2025-03-20 7.1 High
Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links allows Stored XSS.This issue affects Auto Affiliate Links: from n/a through 6.4.2.4.
CVE-2023-25973 1 Flamescorpion 1 Auto Affiliate Links 2025-03-20 5.4 Medium
Cross-Site Request Forgery (CSRF) vulnerability in Lucian Apostol Auto Affiliate Links plugin <= 6.3.0.2 versions.
CVE-2024-6244 2 Projectzealous, Wordpress Plugin 2 Pz Frontend Manager, Pz Frontend Manager 2025-03-19 8.8 High
The PZ Frontend Manager WordPress plugin before 1.0.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
CVE-2024-30454 1 Veronalabs 1 Wp Sms 2025-03-19 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in VeronaLabs WP SMS.This issue affects WP SMS: from n/a through 6.6.2.
CVE-2024-32712 1 Podlove 1 Podlove Podcast Publisher 2025-03-19 7.5 High
Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.14.
CVE-2023-25480 1 Boldgrid 1 Post And Page Builder 2025-03-19 4.3 Medium
Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.24.1 versions.
CVE-2023-25767 1 Jenkins 1 Azure Credentials 2025-03-19 8.8 High
A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-specified web server.
CVE-2024-43984 1 Podlove 1 Podlove Podcast Publisher 2025-03-19 9.6 Critical
Cross-Site Request Forgery (CSRF) vulnerability in Podlove Podlove Podcast Publisher allows Code Injection.This issue affects Podlove Podcast Publisher: from n/a through 4.1.13.
CVE-2023-30456 2 Linux, Redhat 4 Linux Kernel, Enterprise Linux, Rhel Eus and 1 more 2025-03-19 6.5 Medium
An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on x86_64 lacks consistency checks for CR0 and CR4.
CVE-2023-23847 1 Jenkins 1 Synopsys Coverity 2025-03-19 3.5 Low
A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.