CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

14858 matches found

CVE•added 2026/05/29 10:57 a.m.•43 views

CVE-2025-41276

CVE-2025-41276 affects Waterfall WF-500 TX and RX Hosts (Console WebUI) running version 7.9.1.0 R2502171040. Nozomi Networks Labs identifies CWE-78 (OS Command Injection) allowing remote unauthenticated attackers to execute arbitrary operating system commands on the device. The vulnerability is t...

9.8CVSS6.6AI score0.0138EPSS

SaveExploits0References1Affected Software1

Vulnrichment•added 2026/05/29 10:57 a.m.•28 views

CVE-2025-41276

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that allows remote unauthenticated attackers to execute arbitrary operating...

9.3CVSS6.6AI score0.0138EPSS

SaveExploits0References1

Cvelist•added 2026/05/29 10:56 a.m.•65 views

CVE-2025-41275

9.3CVSS0.0138EPSS

SaveExploits0References1

attackerkb•added 2026/05/29 10:56 a.m.•15 views

CVE-2025-41275

9.3CVSS6.1AI score0.0138EPSS

SaveExploits0References2

attackerkb•added 2026/05/29 10:53 a.m.•23 views

CVE-2025-41274

9.3CVSS6.1AI score0.0138EPSS

SaveExploits0References2

Vulnrichment•added 2026/05/29 10:52 a.m.•29 views

CVE-2025-41272

9.3CVSS6.6AI score0.0138EPSS

SaveExploits0References1

Cvelist•added 2026/05/29 10:51 a.m.•64 views

CVE-2025-41270

9.3CVSS0.0138EPSS

SaveExploits0References1

CVE•added 2026/05/29 10:51 a.m.•44 views

CVE-2025-41270

CVE-2025-41270 affects Waterfall WF-500 TX and RX Hosts (version 7.9.1.0 R2502171040). The vulnerability is in the Console WebUI and stems from CWE-78, Improper Neutralization of Special Elements used in an OS Command (OS Command Injection). It allows remote unauthenticated attackers to execute a...

9.8CVSS6.6AI score0.0138EPSS

SaveExploits0References1Affected Software1

attackerkb•added 2026/05/29 10:51 a.m.•17 views

CVE-2025-41270

9.3CVSS6.1AI score0.0138EPSS

SaveExploits0References2

EUVD•added 2026/05/29 10:51 a.m.•26 views

EUVD-2025-209990

9.3CVSS6.1AI score0.0138EPSS

SaveExploits0References1

Cvelist•added 2026/05/29 10:48 a.m.•58 views

CVE-2025-41267

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' in the Administration WebUI in Waterfall WF-500 TX Host in version 7.9.1.0 R2502171040 that allows remote authenticated attackers to execute arbitrary operating syste...

8.5CVSS0.00882EPSS

SaveExploits0References1

attackerkb•added 2026/05/29 10:48 a.m.•18 views

CVE-2025-41267

8.5CVSS6.1AI score0.00882EPSS

SaveExploits0References2

Vulnrichment•added 2026/05/29 10:48 a.m.•33 views

CVE-2025-41266

8.6CVSS6.5AI score0.00882EPSS

SaveExploits0References1

Cvelist•added 2026/05/29 10:48 a.m.•62 views

CVE-2025-41266

8.6CVSS0.00882EPSS

SaveExploits0References1

Rapid7 Vulnerability Database (full)•added 2026/05/29 12:00 a.m.•6 views

CVE-2026-45578: Improper Neutralization of Special Elements used in an OS Command

WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notification branch in plugin/Live/onpublish.php builds an execAsync command line by string concatenation, single-quoting each argument but never calling...

8.8CVSS6AI score0.0053EPSS

SaveExploits0References3

Rapid7 Vulnerability Database (full)•added 2026/05/29 12:00 a.m.•7 views

CVE-2026-45629: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.28.8 and earlier, authenticated OS command injection in the /listen-deployment WebSocket endpoint allows any organization member to execute arbitrary system commands on remote servers managed by Dokploy, leading to full server...

9.9CVSS6.3AI score0.00942EPSS

SaveExploits0References2

Rapid7 Vulnerability Database (full)•added 2026/05/29 12:00 a.m.•3 views

CVE-2026-45630: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.28.8 and earlier, authenticated OS command injection in the application.updateTraefikConfig tRPC endpoint allows admin/owner users to execute arbitrary system commands on remote servers via unsanitized echo shell interpolation...

9CVSS6.3AI score0.00949EPSS

SaveExploits0References2

Rapid7 Vulnerability Database (full)•added 2026/05/29 12:00 a.m.•1 views

CVE-2026-45632: Improper Neutralization of Special Elements used in an OS Command

Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a result, any authenticated user can create, update, run, or delete schedules belonging to other organizations if they know the scheduleId/serverId...

9.9CVSS6AI score0.00318EPSS

SaveExploits0References4

Rapid7 Vulnerability Database (full)•added 2026/05/29 12:00 a.m.•3 views

CVE-2026-45626: Improper Neutralization of Special Elements used in an OS Command

Arcane is an interface for managing Docker containers, images, networks, and volumes. In 1.18.1 and earlier, GET /environments/id/volumes/volumeName/browse accepts a path query parameter that is passed to a shell command sh -c "find … | while …" inside an Arcane helper container. The path sanitis...

6.3CVSS6.2AI score0.00356EPSS

SaveExploits0References2

Rapid7 Vulnerability Database (full)•added 2026/05/29 12:00 a.m.•6 views

CVE-2025-41277: Improper Neutralization of Special Elements used in an OS Command

9.8CVSS6.4AI score0.0138EPSS

SaveExploits0References3

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by