Search

Expected end of text, found '.' (at char 24), (line:1, col:25)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (369812 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-27403 2026-07-23 6.5 Medium
Contributor Cross Site Scripting (XSS) in Hubbub Lite <= 1.36.3 versions.
CVE-2026-27399 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.
CVE-2026-27392 2026-07-23 4.3 Medium
Contributor Broken Access Control in uListing <= 2.2.0 versions.
CVE-2026-27391 2026-07-23 5.4 Medium
Subscriber Broken Access Control in uListing <= 2.2.0 versions.
CVE-2026-27372 2026-07-23 6.5 Medium
Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.
CVE-2026-27355 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.
CVE-2026-25466 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.
CVE-2026-25427 2026-07-23 5.4 Medium
Subscriber Broken Access Control in eRoom <= 1.7.1 versions.
CVE-2026-25424 2026-07-23 4.3 Medium
Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.
CVE-2026-25405 2026-07-23 8.5 High
Contributor SQL Injection in eRoom <= 1.7.1 versions.
CVE-2026-24639 2026-07-23 4.4 Medium
Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions.
CVE-2026-24628 2026-07-23 5.9 Medium
Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions.
CVE-2026-24552 2026-07-23 8.5 High
Contributor SQL Injection in Create by Mediavine <= 2.5.3 versions.
CVE-2026-24537 2026-07-23 4.3 Medium
Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions.
CVE-2025-68081 2026-07-23 5.9 Medium
Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.
CVE-2026-47708 1 Sepinetam 1 Stata-mcp 2026-07-23 N/A
MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the `log_file_name` parameter in the `stata_do` API and CLI is directly interpolated into a Stata command string without sanitization. The security guard (`GuardValidator`) only scans the do-file content but does not validate this parameter. An attacker can inject arbitrary Stata commands (including `shell`, `python`, `erase`, etc.) by crafting a malicious `log_file_name` containing quotes, newlines, or Stata command separators. Version 1.17.3 contains a patch for the issue.
CVE-2026-47010 1 Oracle 4 Graalvm, Graalvm Enterprise Edition, Graalvm For Jdk and 1 more 2026-07-23 3.7 Low
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 3.7 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2026-59677 1 Selinux Project 1 Selinux 2026-07-23 N/A
A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in unconfined context This issue affects policycoreutils through 3.10.
CVE-2026-15761 2 Tickera, Wordpress 2 Tickera – Sell Tickets & Manage Events, Wordpress 2026-07-23 6.5 Medium
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerable code path is reachable by users holding the plugin's custom Staff role, as the plugin's add_required_capabilities() function grants that role the edit_tc_tickets_instances capability, providing access to the tc_tickets_instances admin list screen where the filter is applied.
CVE-2026-64611 1 Redhat 1 Enterprise Linux 2026-07-23 7.5 High
A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service.