Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (358460 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-25836 1 Fortinet 3 Fortisandbox Cloud, Fortisandboxcloud, Fortisandboxpaas 2026-06-16 6.7 Medium
An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox Cloud 5.0.4, FortiSandbox PaaS 5.0.4 may allow a privileged attacker with super-admin profile and CLI access to execute unauthorized code or commands via crafted HTTP requests.
CVE-2026-26791 1 Gl-inet 3 Ar300m16, Ar300m16 Firmware, Gl-ar300m16 2026-06-16 9.8 Critical
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the string port parameter in the enable_echo_server function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
CVE-2026-26792 1 Gl-inet 3 Ar300m16, Ar300m16 Firmware, Gl-ar300m16 2026-06-16 9.8 Critical
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain multiple command injection vulnerabilities in the set_upgrade function via the modem_url, target_version, current_version, firmware_upload, hash_type, hash_value, and upgrade_type parameters. These vulnerabilities allow attackers to execute arbitrary commands via a crafted input.
CVE-2026-26795 1 Gl-inet 3 Ar300m16, Ar300m16 Firmware, Gl-ar300m16 2026-06-16 9.8 Critical
GL-iNet GL-AR300M16 v4.3.11 was discovered to contain a command injection vulnerability via the module parameter in the M.get_system_log function. This vulnerability allows attackers to execute arbitrary commands via a crafted input.
CVE-2026-32746 1 Gnu 1 Inetutils 2026-06-16 9.8 Critical
telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.
CVE-2026-42384 2 Nsquared, Wordpress 2 Simply Schedule Appointments, Wordpress 2026-06-16 7.5 High
Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11.2 versions.
CVE-2026-49110 2 Wordpress, Wp Swings 2 Wordpress, Upsell Order Bump Offer For Woocommerce 2026-06-16 7.5 High
Unauthenticated Broken Authentication in Upsell Order Bump Offer for WooCommerce <= 3.1.4 versions.
CVE-2026-39491 2 Artbees, Wordpress 2 Jupiter X Core, Wordpress 2026-06-16 6.5 Medium
Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.
CVE-2026-39534 2026-06-16 7.5 High
Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.
CVE-2026-39524 2026-06-16 7.5 High
Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.
CVE-2026-39503 2 Awesomemotive, Wordpress 2 Easy Digital Downloads, Wordpress 2026-06-16 7.5 High
Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.
CVE-2026-39468 2026-06-16 6.8 Medium
Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versions.
CVE-2026-39447 2 Nsquared, Wordpress 2 Simply Schedule Appointments, Wordpress 2026-06-16 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions.
CVE-2026-34900 2 Liquid Web / Stellarwp, Wordpress 2 Givewp, Wordpress 2026-06-16 7.1 High
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.
CVE-2026-39498 2026-06-16 7.2 High
Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.
CVE-2026-23970 2 Themeisle, Wordpress 2 Redirection For Contact Form 7, Wordpress 2026-06-16 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.
CVE-2025-60175 2026-06-16 4.4 Medium
Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions.
CVE-2026-27333 2 Videowhisper.com, Wordpress 2 Paid Videochat Turnkey Site, Wordpress 2026-06-16 8.1 High
Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions.
CVE-2026-48780 2026-06-16 8.2 High
Forem is open source software for building communities. Prior to commit a2ab6d4, a maliciously crafted email address could allow an attacker to bypass domain allowlist or denylist restrictions and gain access to invite-only forem deployments. The issue is patched as of `a2ab6d4`. As a workaround, some SMTP servers and email delivery providers may drop or refuse to send maliciously crafted email addresses.
CVE-2024-22447 2026-06-16 6.7 Medium
Dell Peripheral Manager, versions prior to 1.7.3, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious dll., leading to arbitrary code execution.