Search

Expected end of text, found '.' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (382036 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-62553 1 Oracle 1 Hyperion Infrastructure Technology 2026-08-21 5.5 Medium
Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Infrastructure Technology executes to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-14476 2 Redhat, Sssd 11 Enterprise Linux, Enterprise Linux Eus, Openshift and 8 more 2026-08-21 8 High
A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.
CVE-2026-73354 2 Reichertbrothers, Wordpress 2 Simplyrets Real Estate Idx, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in SimplyRETS Real Estate IDX <= 3.2.8 versions.
CVE-2026-73364 2 Wordpress, Wpdesk 2 Wordpress, Flexible Subscriptions 2026-08-21 9.8 Critical
Customer PHP Object Injection in Flexible Subscriptions <= 1.8.1 versions.
CVE-2026-73384 2 Cmsminds, Wordpress 2 Pay With Contact Form 7, Wordpress 2026-08-21 7.5 High
Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.
CVE-2026-73385 2 Outanking Team, Wordpress 2 Outranking Plugin Options, Wordpress 2026-08-21 7.5 High
Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.
CVE-2026-73387 2 Smartdatasoft, Wordpress 2 Resido, Wordpress 2026-08-21 8.1 High
Unauthenticated Local File Inclusion in Resido <= 1.5 versions.
CVE-2026-73389 2 The4, Wordpress 2 Kalles Addons, Wordpress 2026-08-21 9.8 Critical
Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.
CVE-2026-73390 2 Klbtheme, Wordpress 2 Total Donations, Wordpress 2026-08-21 9.8 Critical
Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.
CVE-2026-73391 2 Klbtheme, Wordpress 2 Total Donations, Wordpress 2026-08-21 9.3 Critical
Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.
CVE-2025-6032 1 Redhat 3 Enterprise Linux, Openshift, Rhel Eus 2026-08-21 8.3 High
A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
CVE-2026-77067 1 Omnivore-app 1 Omnivore 2026-08-21 5 Medium
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.ts issues axios.request with that url, the method and Content-Type recorded on the webhook, and a JSON body carrying the event data, so an authenticated user can make the server send repeated attacker-shaped requests to internal endpoints, including link-local metadata addresses. The request is blind: callWebhook discards the result and writes only a success line or the axios error to the server log, so the response is not returned through the API.
CVE-2026-74021 2 Anders Norén, Wordpress 2 Chaplin, Wordpress 2026-08-21 7.5 High
Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.
CVE-2025-15637 2 Edge Themes, Wordpress 2 Shuffle, Wordpress 2026-08-21 8.1 High
Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.
CVE-2026-66590 2 Tagembed, Wordpress 2 Tagembed, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.
CVE-2026-66594 2 Lukeseager, Wordpress 2 Wordpress Persistent Login, Wordpress 2026-08-21 8.5 High
Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.
CVE-2026-66598 2 Kingtech Llc., Wordpress 2 B2bking Premium, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.
CVE-2026-66605 2 Hasthemes, Wordpress 2 Swatchly – Woocommerce Variation Swatches For Products, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.
CVE-2026-66606 2 Themegrill, Wordpress 2 Smartsmtp, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.
CVE-2026-66609 2 Codexthemes, Wordpress 2 Thegem (elementor), Wordpress 2026-08-21 9.3 Critical
Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.