Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (94 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-11980 4 Apple, Ibm, Linux and 1 more 5 Macos, Aspera, Aspera Desktop App and 2 more 2026-08-13 7.3 High
IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up.
CVE-2026-14973 4 Apple, Ibm, Linux and 1 more 5 Macos, Aspera, Aspera Desktop App and 2 more 2026-08-13 9.3 Critical
IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.
CVE-2025-13379 1 Ibm 1 Aspera Console 2026-02-12 8.6 High
IBM Aspera Console 3.4.0 through 3.4.8 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
CVE-2025-13925 1 Ibm 1 Aspera Console 2026-01-30 4.9 Medium
IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged user.
CVE-2025-36228 1 Ibm 2 Aspera Faspex, Aspera Faspex 5 2025-12-29 3.8 Low
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 may allow inconsistent permissions between the user interface and backend API allowed users to access features that appeared disabled, potentially leading to misuse.
CVE-2025-36229 1 Ibm 2 Aspera Faspex, Aspera Faspex 5 2025-12-29 3.1 Low
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 could allow authenticated users to enumerate sensitive information of data due by enumerating package identifiers.
CVE-2025-36230 1 Ibm 2 Aspera Faspex, Aspera Faspex 5 2025-12-29 5.4 Medium
IBM Aspera Faspex 5 5.0.0 through 5.0.14.1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site.
CVE-2025-13148 2 Ibm, Linux 2 Aspera Orchestrator, Linux Kernel 2025-12-15 8.1 High
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow could an authenticated user to change the password of another user without prior knowledge of that password.
CVE-2025-13211 2 Ibm, Linux 2 Aspera Orchestrator, Linux Kernel 2025-12-15 5.3 Medium
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to cause a denial of service in the email service due to improper control of interaction frequency.
CVE-2025-13214 2 Ibm, Linux 2 Aspera Orchestrator, Linux Kernel 2025-12-15 7.6 High
IBM Aspera Orchestrator 4.0.0 through 4.1.0 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.
CVE-2025-13481 2 Ibm, Linux 2 Aspera Orchestrator, Linux Kernel 2025-12-15 8.8 High
IBM Aspera Orchestrator 4.0.0 through 4.1.0 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input.
CVE-2025-36274 1 Ibm 1 Aspera Http Gateway 2025-12-11 7.5 High
IBM Aspera HTTP Gateway 2.0.0 through 2.3.1 stores sensitive information in clear text in easily obtainable files which can be read by an unauthenticated user.
CVE-2022-47986 3 Ibm, Linux, Microsoft 3 Aspera Faspex, Linux Kernel, Windows 2025-10-27 9.8 Critical
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
CVE-2025-36225 3 Ibm, Linux, Microsoft 3 Aspera Faspex, Linux Kernel, Windows 2025-10-14 4.3 Medium
IBM Aspera 5.0.0 through 5.0.13.1 could disclose sensitive user information from the system to an authenticated user due to an observable discrepancy of returned data.
CVE-2023-37401 3 Ibm, Linux, Microsoft 3 Aspera Faspex, Linux Kernel, Windows 2025-10-14 5.3 Medium
IBM Aspera Faspex 5.0.0 through 5.0.13.1 uses a cross-domain policy file that includes domains that should not be trusted.
CVE-2025-36171 3 Ibm, Linux, Microsoft 3 Aspera Faspex, Linux Kernel, Windows 2025-10-14 4.9 Medium
IBM Aspera Faspex 5.0.0 through 5.0.13.1 could allow a privileged user to cause a denial of service from improperly validated API input due to excessive resource consumption.
CVE-2025-3423 2 Ibm, Linux 2 Aspera Faspex, Linux Kernel 2025-09-01 5.4 Medium
IBM Aspera Faspex 5.0.0 through 5.0.11 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVE-2025-0162 1 Ibm 1 Aspera Shares 2025-09-01 7.1 High
IBM Aspera Shares 1.9.9 through 1.10.0 PL7 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to expose sensitive information or consume memory resources.
CVE-2025-33137 2 Ibm, Linux 2 Aspera Faspex, Linux Kernel 2025-08-26 7.1 High
IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to client-side enforcement of server-side security.
CVE-2025-33136 2 Ibm, Linux 2 Aspera Faspex, Linux Kernel 2025-08-26 7.1 High
IBM Aspera Faspex 5.0.0 through 5.0.12 could allow an authenticated user to obtain sensitive information or perform unauthorized actions on behalf of another user due to improper protection of assumed immutable data.