Search

Expected end of text, found '.' (at char 51), (line:1, col:52)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (358285 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-54197 2026-06-16 6.5 Medium
Unauthenticated Sensitive Data Exposure in GetGenie <= 4.4.1 versions.
CVE-2026-54191 2026-06-16 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.
CVE-2026-54190 2026-06-16 6.5 Medium
Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.
CVE-2026-52715 2026-06-16 9.3 Critical
Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.
CVE-2026-52714 2026-06-16 7.5 High
Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.
CVE-2026-52712 2026-06-16 7.6 High
Subscriber SQL Injection in Attendance Manager <= 0.6.2 versions.
CVE-2026-52711 2026-06-16 7.5 High
Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.
CVE-2026-39581 2026-06-16 8.5 High
Subscriber SQL Injection in WP Sessions Time Monitoring Full Automatic <= 1.1.4 versions.
CVE-2026-39574 2026-06-16 9.3 Critical
Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.
CVE-2026-39437 2026-06-16 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions.
CVE-2025-68045 2026-06-16 7.5 High
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions.
CVE-2026-24061 2 Debian, Gnu 2 Debian Linux, Inetutils 2026-06-16 9.8 Critical
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
CVE-2026-6517 1 Mattermost 1 Mattermost 2026-06-16 6.3 Medium
Mattermost Desktop App versions <=6.1 5.5.13.0 fail to restrict the allow list of domains to which NTLM credentials were forwarded to in the Mattermost Desktop App which allows any user on a server without the image proxy enabled to intercept other users credentials via embedding an image that routes to an external web server. Mattermost Advisory ID: MMSA-2026-00651
CVE-2026-47261 1 Bytecodealliance 1 Wasmtime 2026-06-16 7.5 High
Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.open-at or wasip1 path_open interfaces by opening a file with only the OpenFlags::TRUNCATE oflag. The root cause is that the clause handling OpenFlags::TRUNCATE in crates/wasi/src/filesystem.rs (Dir::open_at, lines 967–969) did not set open_mode |= OpenMode::WRITE;, which is later used for the access control check against FilePerms to determine whether opening the file is permitted; the single-line fix adds that missing assignment, after which the affected calls correctly fail with error-code.not-permitted and ERRNO_PERM respectively. Only wasmtime-wasi embeddings that combine DirPerms::MUTATE with FilePerms::READ are affected by this bug. In particular, the Wasmtime project's wasmtime-cli's use of wasmtime-wasi is not affected, because it always sets FilePerms::all() for all preopens. This issue has been fixed in versions 24.0.9, 36.0.10 and44.0.2.
CVE-2026-39465 2 Metaslider, Wordpress 2 Responsive Slider By Metaslider, Wordpress 2026-06-16 9.1 Critical
Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.
CVE-2026-39472 2 Wordpress, Wpovernight 2 Wordpress, Woocommerce Pdf Invoices\& Packing Slips 2026-06-16 7.2 High
Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.
CVE-2026-39513 2 Easy-appointments, Wordpress 2 Easy Appointments, Wordpress 2026-06-16 7.5 High
Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.
CVE-2026-40762 2 Wordpress, Wpgraphql 2 Wordpress, Wpgraphql 2026-06-16 7.5 High
Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.
CVE-2026-40790 2 Veronalabs, Wordpress 2 Wp Sms, Wordpress 2026-06-16 6.5 Medium
Subscriber Sensitive Data Exposure in WP SMS <= 7.2.1 versions.
CVE-2026-42651 2 Mamunur Rashid, Wordpress 2 Classified Listing, Wordpress 2026-06-16 6.3 Medium
Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions.