Search

Expected end of text, found '.' (at char 14), (line:1, col:15)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (381531 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-75911 1 Hmbown 1 Codewhale 2026-08-18 7.8 High
CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a malicious .codewhale/config.toml file to a repository. When a user clones and opens the repository in CodeWhale, the AI model gains access to exec_shell and task_shell tools, enabling execution of arbitrary shell commands on the victim's machine without explicit user consent.
CVE-2026-75897 2 Aws, Opensearch 2 Amazon Opensearch Service, Opensearch Dashboards 2026-08-18 7.5 High
Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.
CVE-2026-74046 2026-08-18 4.9 Medium
Wazuh 4.4.0 before 4.14.7 contains a denial of service vulnerability in the fdecompress_files() function within cluster.py that allows authenticated cluster peers to exhaust memory by supplying a malicious synchronization archive without decompressed size limits. Attackers holding a valid cluster Fernet key can upload a small, highly compressed zip bomb archive that forces wazuh-clusterd on the master node to decompress the full payload into memory, causing memory exhaustion and service disruption.
CVE-2026-74009 2 Razorpay, Wordpress 2 Razorpay For Woocommerce, Wordpress 2026-08-18 5.3 Medium
Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions.
CVE-2026-74006 2026-08-18 4.3 Medium
Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.
CVE-2026-74003 2 Rometheme, Wordpress 2 Romethemeform For Elementor, Wordpress 2026-08-18 4.3 Medium
Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.
CVE-2026-73995 2 Wordpress, Wpeverest 2 Wordpress, User Registration 2026-08-18 5.4 Medium
Subscriber Broken Authentication in User Registration <= 5.2.6 versions.
CVE-2026-73404 2026-08-18 6.5 Medium
Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.
CVE-2026-73398 2 Papaki, Wordpress 2 Piraeus Bank Woocommerce Payment Gateway, Wordpress 2026-08-18 6.5 Medium
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions.
CVE-2026-73396 2026-08-18 7.1 High
Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.
CVE-2026-73382 2 Geminilabs, Wordpress 2 Site Reviews, Wordpress 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions.
CVE-2026-73379 2026-08-18 6.5 Medium
Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions.
CVE-2026-73367 2 Supsystic, Wordpress 2 Easy Google Maps, Wordpress 2026-08-18 7.2 High
Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.
CVE-2026-73365 2026-08-18 9.3 Critical
Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.
CVE-2026-73360 2 Premio, Wordpress 2 Chaty Pro, Wordpress 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.
CVE-2026-73358 2 Wordpress, Wp.insider 2 Wordpress, Affiliates Manager 2026-08-18 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.
CVE-2026-73352 2 Nexcess, Wordpress 2 Givewp, Wordpress 2026-08-18 6.5 Medium
Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.
CVE-2026-73350 2 Psm Plugins, Wordpress 2 Supportcandy, Wordpress 2026-08-18 8.2 High
Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.
CVE-2026-73343 2 Aresit, Wordpress 2 Wp Compress, Wordpress 2026-08-18 10 Critical
Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
CVE-2026-73341 2 Metagauss, Wordpress 2 Registrationmagic, Wordpress 2026-08-18 9.8 Critical
Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.