Export limit exceeded: 425937 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (7 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-86813 1 Wordpress-extensions 1 Metform 2026-11-13 4.8 Medium
The MetForm WordPress plugin before 4.1.9 does not properly neutralize newline characters in user-submitted values that are placed into notification email headers, allowing unauthenticated attackers to inject additional email headers, such as Bcc, into the emails the site sends when a submitted field value is configured to populate a header.
CVE-2026-120847 2 Wordpress-extensions, Wpmet 2 Metform, Metform 2026-11-07 4.3 Medium
Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through 4.3.3.
CVE-2026-114180 2 Wordpress-extensions, Wpmet 2 Metform, Metform 2026-10-22 5.3 Medium
Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through 4.3.2.
CVE-2026-86833 1 Wordpress-extensions 1 Metform 2026-10-09 5.4 Medium
The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends.
CVE-2026-86832 1 Wordpress-extensions 1 Metform 2026-10-04 5.3 Medium
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST API.
CVE-2026-86834 1 Wordpress-extensions 1 Metform 2026-10-04 3.7 Low
The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission when its HubSpot Forms integration is enabled, allowing unauthenticated attackers to read upstream API response data, including correlation identifiers and cookies.
CVE-2026-103339 2 Wordpress-extensions, Wpmet 2 Metform, Metform 2026-10-01 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet Metform metform allows Stored XSS.This issue affects Metform: from n/a through 4.3.0.