Export limit exceeded: 16188 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16595 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 395993 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found '@' (at char 12), (line:1, col:13)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (395993 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-88854 1 Ordasoft.com 2 Ordasoft Joomla Gallery Extension For Joomla, Ordasoft Joomla Gallery Free Extension For Joomla 2026-09-21 N/A
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions showSearchResult() and showSearchResultAjax() read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login of any kind: mod_osgallery_search is a public, commonly-published search box. Any anonymous site visitor can inject a UNION SELECT and read arbitrary database content.
CVE-2026-88807 1 X.org 1 Libxrender 2026-09-21 N/A
A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.
CVE-2026-88806 1 X.org 1 Libx11 2026-09-21 7.5 High
A malicious X server could exploit a buffer overflow in libX11 before 1.8.14 during handling of XkbGetMap overflowing the key_sym_map.
CVE-2026-87283 1 Oracle 1 Vm Virtualbox 2026-09-21 6 Medium
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 6.0 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H).
CVE-2026-85113 2 Givewp, Wordpress 2 Givewp, Wordpress 2026-09-21 6.5 Medium
The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
CVE-2026-82187 2026-09-21 9.8 Critical
The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it, allowing unauthenticated attackers to upload arbitrary files, including PHP ones, and run code on the server.
CVE-2025-33147 1 Ibm 1 Cognos Analytics 2026-09-21 5.9 Medium
IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitive information caused by insecure network communication.
CVE-2026-93373 1 Google 1 Chrome 2026-09-21 9.6 Critical
Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
CVE-2026-93372 1 Google 2 Android, Chrome 2026-09-21 9.6 Critical
Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-69353 1 Microsoft 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more 2026-09-21 5.5 Medium
Out-of-bounds read in Windows Text Shaping allows an authorized attacker to disclose information locally.
CVE-2026-83411 1 Oracle 1 Coherence 2026-09-21 8.8 High
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Coherence. Successful attacks of this vulnerability can result in takeover of Oracle Coherence. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-69371 1 Microsoft 25 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 22 more 2026-09-21 8 High
Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges over a network.
CVE-2026-69381 1 Microsoft 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more 2026-09-21 4.6 Medium
Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacker to disclose information with a physical attack.
CVE-2026-69393 1 Microsoft 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more 2026-09-21 5.7 Medium
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information over a network.
CVE-2026-65492 2 Dokan Wordpress Plugin, Wordpress 2 Dokan Pro, Wordpress 2026-09-21 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affects Dokan Pro: from n/a before 5.0.7.
CVE-2026-69617 1 Microsoft 4 Windows 11 26h1, Windows 11 26h1, Windows Server 2025 and 1 more 2026-09-21 7 High
Out-of-bounds read in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
CVE-2026-91742 2 Apple, Google 2 Iphone Os, Chrome 2026-09-21 4.8 Medium
Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)
CVE-2026-93381 2 Google, Microsoft 2 Chrome, Windows 2026-09-21 8.8 High
Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
CVE-2026-91865 1 Apache 1 Neethi 2026-09-21 7.5 High
A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalization, consuming huge amounts of CPU and memory (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.
CVE-2026-91864 1 Apache 1 Neethi 2026-09-21 7.5 High
A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without counting it against its size limits, exhausting the heap (denial of service). Users are recommended to upgrade to version 3.2.4, which fixes this issue.