Search

Expected end of text, found '.' (at char 11), (line:1, col:12)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (380538 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2023-5758 1 Mozilla 1 Firefox Mobile 2026-08-19 6.1 Medium
When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack. This vulnerability affects Firefox for iOS < 119.
CVE-2019-17003 1 Mozilla 1 Firefox Mobile 2026-08-19 6.1 Medium
Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed.
CVE-2020-15662 1 Mozilla 1 Firefox Mobile 2026-08-19 6.5 Medium
A rogue webpage could override the injected WKUserScript used by the download feature, this exploit could result in the user downloading an unintended file. This vulnerability affects Firefox for iOS < 28.
CVE-2020-12404 1 Mozilla 1 Firefox Mobile 2026-08-19 4.3 Medium
For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS < 26.
CVE-2020-6830 1 Mozilla 1 Firefox Mobile 2026-08-19 7.5 High
For native-to-JS bridging, the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token was being used for JS-to-native also, but it isn't needed in this case, and its usage was also leaking this token. This vulnerability affects Firefox for iOS < 25.
CVE-2020-12414 1 Mozilla 1 Firefox Mobile 2026-08-19 6.5 Medium
IndexedDB should be cleared when leaving private browsing mode and it is not, the API for WKWebViewConfiguration was being used incorrectly and requires the private instance of this object be deleted when leaving private mode. This vulnerability affects Firefox for iOS < 27.
CVE-2020-15661 1 Mozilla 1 Firefox Mobile 2026-08-19 6.5 Medium
A rogue webpage could override the injected WKUserScript used by the logins autofill, this exploit could result in leaking a password for the current domain. This vulnerability affects Firefox for iOS < 28.
CVE-2024-43113 1 Mozilla 1 Firefox Mobile 2026-08-19 6.1 Medium
The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129.
CVE-2026-71121 1 Oracle 1 Hyperion Financial Management 2026-08-19 6.5 Medium
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
CVE-2026-71131 1 Oracle 1 Vm Virtualbox 2026-08-19 8.6 High
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
CVE-2026-61986 2 Wasiliy Strecker, Wordpress 2 Contest Gallery, Wordpress 2026-08-19 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.
CVE-2026-66668 2 Peepso, Wordpress 2 Community By Peepso, Wordpress 2026-08-19 8.5 High
Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.
CVE-2026-73184 2 Lcweb, Wordpress 2 Global Gallery, Wordpress 2026-08-19 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Global Gallery <= 11.1.2 versions.
CVE-2026-73185 2 Wordpress, Wpo-hr 2 Wordpress, Ngg Smart Image Search 2026-08-19 9.3 Critical
Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.
CVE-2026-73347 2 Themetechmount, Wordpress 2 Truebooker, Wordpress 2026-08-19 9.8 Critical
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.
CVE-2020-12401 2 Mozilla, Redhat 4 Firefox, Firefox Mobile, Enterprise Linux and 1 more 2026-08-19 4.7 Medium
During ECDSA signature generation, padding applied in the nonce designed to ensure constant-time scalar multiplication was removed, resulting in variable-time execution dependent on secret data. This vulnerability affects Firefox < 80 and Firefox for Android < 80.
CVE-2021-29993 1 Mozilla 1 Firefox Mobile 2026-08-19 8.1 High
Firefox for Android allowed navigations through the `intent://` protocol, which could be used to cause crashes and UI spoofs. *This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 92.
CVE-2022-26485 2 Mozilla, Redhat 7 Firefox, Firefox Focus, Firefox Mobile and 4 more 2026-08-19 8.8 High
Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
CVE-2022-26486 2 Mozilla, Redhat 7 Firefox, Firefox Focus, Firefox Mobile and 4 more 2026-08-19 9.6 Critical
An unexpected message in the WebGPU IPC framework could lead to a use-after-free and exploitable sandbox escape. We have had reports of attacks in the wild abusing this flaw. This vulnerability affects Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0.
CVE-2023-29533 2 Mozilla, Redhat 10 Firefox, Firefox Esr, Firefox Mobile and 7 more 2026-08-19 4.3 Medium
A website could have obscured the fullscreen notification by using a combination of <code>window.open</code>, fullscreen requests, <code>window.name</code> assignments, and <code>setInterval</code> calls. This could have led to user confusion and possible spoofing attacks. This vulnerability affects Firefox < 112, Focus for Android < 112, Firefox ESR < 102.10, Firefox for Android < 112, and Thunderbird < 102.10.