Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (7954 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-43461 1 Apple 2 Macos, Macos Tahoe 2026-04-02 5.5 Medium
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data.
CVE-2024-44175 1 Apple 1 Macos 2026-04-02 7.5 High
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7.1. An app may be able to access sensitive user data.
CVE-2025-43381 1 Apple 2 Macos, Macos Tahoe 2026-04-02 5.5 Medium
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.1. A malicious app may be able to delete protected user data.
CVE-2025-43475 1 Apple 3 Ios, Ipados, Iphone Os 2026-04-02 5.5 Medium
A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2. An app may be able to access user-sensitive data.
CVE-2026-20694 1 Apple 4 Ios And Ipados, Ipados, Iphone Os and 1 more 2026-04-02 5.5 Medium
This issue was addressed with improved handling of symlinks. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.4, macOS Sonoma 14.8.5, macOS Tahoe 26.3, macOS Tahoe 26.4. An app may be able to access user-sensitive data.
CVE-2025-43252 1 Apple 2 Macos, Macos Sequoia 2026-04-02 6.5 Medium
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15.6. A website may be able to access sensitive user data when resolving symlinks.
CVE-2024-27849 1 Apple 1 Macos 2026-04-02 3.3 Low
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15. An app may be able to read sensitive location information.
CVE-2026-20646 1 Apple 1 Macos 2026-04-02 3.3 Low
A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.3. A malicious app may be able to read sensitive location information.
CVE-2026-28866 1 Apple 4 Ios And Ipados, Ipados, Iphone Os and 1 more 2026-04-02 6.2 Medium
This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to access sensitive user data.
CVE-2026-20610 1 Apple 1 Macos 2026-04-02 7.8 High
This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.3. An app may be able to gain root privileges.
CVE-2024-44131 1 Apple 3 Ipados, Iphone Os, Macos 2026-04-02 5.5 Medium
This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequoia 15. An app may be able to access sensitive user data.
CVE-2026-32982 1 Openclaw 1 Openclaw 2026-04-02 7.5 High
OpenClaw before 2026.3.13 contains an information disclosure vulnerability in the fetchRemoteMedia function that exposes Telegram bot tokens in error messages. When media downloads fail, the original Telegram file URLs containing bot tokens are embedded in MediaFetchError strings and leaked to logs and error surfaces.
CVE-2021-42744 1 Philips 4 Mri 1.5t, Mri 1.5t Firmware, Mri 3t and 1 more 2026-04-02 5.5 Medium
Philips MRI 1.5T and MRI 3T Version 5.3 through 5.8.1 does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CVE-2026-1542 2 Super Stage Wp, Wordpress 2 Super Stage Wp, Wordpress 2026-04-02 6.5 Medium
The Super Stage WP WordPress plugin through 1.0.1 unserializes user input via REQUEST, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
CVE-2026-1235 2 Wordpress, Wp Ecommerce 2 Wordpress, Wp Ecommerce 2026-04-02 6.5 Medium
The WP eCommerce WordPress plugin through 3.15.1 unserializes user input via ajax actions, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
CVE-2026-21670 1 Veeam 2 Backup And Replication, Veeam Backup \& Replication 2026-04-02 7.7 High
A vulnerability allowing a low-privileged user to extract saved SSH credentials.
CVE-2026-25449 2 Shinetheme, Wordpress 2 Traveler, Wordpress 2026-04-02 N/A
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.
CVE-2026-23658 1 Microsoft 2 Azure Devops, Azure Devops Msazure 2026-04-02 8.6 High
Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-0677 2 Totalsuite, Wordpress 2 Totalcontest, Wordpress 2026-04-02 N/A
Deserialization of Untrusted Data vulnerability in TotalSuite TotalContest Lite totalcontest-lite allows Object Injection.This issue affects TotalContest Lite: from n/a through <= 2.9.1.
CVE-2025-36187 2 Ibm, Redhat 3 Knowledge Catalog, Knowledge Catalog Standard Cartridge, Openshift 2026-04-02 4.4 Medium
IBM Knowledge Catalog Standard Cartridge 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1 stores potentially sensitive information in log files that could be read by a local privileged user.