Search

Expected end of text, found '–' (at char 49), (line:1, col:50)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (373407 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-65575 2026-08-06 9.8 Critical
Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.
CVE-2026-65570 2026-08-06 8.1 High
Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.
CVE-2026-16954 2026-08-06 6.5 Medium
The AI Engine WordPress plugin before 3.6.4 does not redact secret configuration values before exposing them in an admin page's inline script data, allowing users with the Editor role to read the site's stored third-party API key and authentication tokens in cleartext, despite those secrets being restricted to administrators everywhere else.
CVE-2026-65565 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.
CVE-2026-65560 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.
CVE-2026-65559 2026-08-06 7.2 High
Shop manager Privilege Escalation in Order Delivery Date for WooCommerce <= 4.6.0 versions.
CVE-2026-65552 2026-08-06 9.8 Critical
Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.
CVE-2026-65549 2026-08-06 7.2 High
Author PHP Object Injection in Jeg Kit for Elementor <= 3.2.10 versions.
CVE-2026-65548 2026-08-06 9.9 Critical
Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions.
CVE-2026-65547 2026-08-06 8.5 High
Subscriber SQL Injection in Creative Mail <= 1.6.9 versions.
CVE-2026-65545 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.
CVE-2026-65520 2026-08-06 9.3 Critical
Unauthenticated SQL Injection in WP OAuth Server <= 6.2.0 versions.
CVE-2026-65515 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.35.0 versions.
CVE-2026-65513 2026-08-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions.
CVE-2026-61959 2026-08-06 6.5 Medium
Subscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.
CVE-2026-28183 2026-08-06 7.2 High
Editor Privilege Escalation in PublishPress Capabilities <= 2.45.0 versions.
CVE-2026-28140 2026-08-06 7.5 High
Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.
CVE-2026-25403 2026-08-06 6.5 Medium
Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
CVE-2026-14829 2026-08-06 8.2 High
The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated attackers to deactivate the Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13's premium licensing state and erase the stored license key.
CVE-2026-70605 1 Electron 1 Electron 2026-08-06 5.9 Medium
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, when following HTTP redirects, net.fetch() and net.request() did not restrict which schemes a redirect could target. A remote server could redirect a request to a local resource, and if the app returns or forwards the response body, local file contents could be disclosed. Apps are only affected if they make net requests to attacker-influenced URLs with redirects followed and expose the response body. This issue is fixed in versions 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3.