Search

Expected end of text, found 'âteau' (at char 35), (line:1, col:36)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (376996 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-28148 2026-08-13 9.8 Critical
Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions.
CVE-2026-28142 2 Shamalli, Wordpress 2 Web Directory Free, Wordpress 2026-08-13 9.3 Critical
Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.
CVE-2026-28008 2026-08-13 9.8 Critical
Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions.
CVE-2026-28004 2026-08-13 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions.
CVE-2026-28003 2026-08-13 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions.
CVE-2026-28002 2026-08-13 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.
CVE-2026-28001 2026-08-13 9.3 Critical
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
CVE-2026-27999 2026-08-13 6.5 Medium
Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.
CVE-2026-27544 2 Quarka, Wordpress 2 Qa Analytics, Wordpress 2026-08-13 10 Critical
Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions.
CVE-2026-27543 2 Fluxbuilder, Wordpress 2 Mstore Api, Wordpress 2026-08-13 8.1 High
Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions.
CVE-2026-27539 2026-08-13 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions.
CVE-2026-27538 2 Wordpress, Wpdirectorykit 2 Wordpress, Wp Directory Kit 2026-08-13 7.5 High
Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions.
CVE-2026-27537 2026-08-13 6.5 Medium
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions.
CVE-2026-27536 2 Pluginops, Wordpress 2 Mailchimp Subscribe Form, Wordpress 2026-08-13 7.1 High
Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions.
CVE-2026-27535 2 Solacewp, Wordpress 2 Solace Extra, Wordpress 2026-08-13 7.1 High
Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.
CVE-2026-27380 2 Magepeopleteam, Wordpress 2 Car Rental Manager, Wordpress 2026-08-13 7.2 High
Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.
CVE-2026-27345 2026-08-13 7.5 High
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.
CVE-2026-21832 2026-08-13 4.3 Medium
HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions.
CVE-2026-19716 1 Maalfer 1 Pentestify 2026-08-13 N/A
Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML() before interpolating it into the onclick attribute of the account deletion button, but the browser HTML-decodes attribute values before the JavaScript engine parses the handler, allowing an encoded single quote (') to break out of the string literal and inject arbitrary JavaScript that executes when the victim clicks the delete button for that account.
CVE-2026-19385 1 Postgresql 1 Postgresql 2026-08-13 8.8 High
Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.