Export limit exceeded: 402604 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (402604 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-39720 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.
CVE-2026-39719 2026-10-06 7.2 High
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
CVE-2026-39599 2026-10-06 4.3 Medium
Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.
CVE-2026-32582 2026-10-06 6.5 Medium
Contributor Broken Access Control in IATO MCP <= 1.11.0 versions.
CVE-2026-32581 2026-10-06 7.1 High
Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.
CVE-2026-32580 2026-10-06 7.5 High
Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.
CVE-2026-32579 2026-10-06 10 Critical
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
CVE-2026-32578 2026-10-06 7.1 High
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
CVE-2026-32577 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.
CVE-2026-32575 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.
CVE-2026-32574 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Smart Forms <= 2.6.104 versions.
CVE-2026-32572 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.
CVE-2026-32571 2026-10-06 6.5 Medium
Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.
CVE-2026-32570 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.
CVE-2026-32569 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
CVE-2026-32568 2026-10-06 9.9 Critical
Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
CVE-2026-32557 2026-10-06 9.3 Critical
Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.
CVE-2026-25434 2026-10-06 8.5 High
Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
CVE-2026-25433 2026-10-06 7.1 High
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
CVE-2026-105985 1 Craftcms 1 Cms 2026-10-06 8.8 High
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate(). This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process. The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.