Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (11337 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-48709 1 Olivetin 1 Olivetin 2026-06-16 3.7 Low
OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unlike all other data-returning API endpoints, it does not call auth.UserFromApiCall or checkDashboardAccess. When AuthRequireGuestsToLogin is enabled (the security-conscious configuration), this endpoint remains accessible to unauthenticated users and can be used as an oracle to enumerate valid action binding IDs and their argument configurations. This issue has been fixed in version 3000.13.0.
CVE-2026-40793 2 Groundhogg, Wordpress 2 Groundhogg, Wordpress 2026-06-16 6.5 Medium
Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.
CVE-2026-42640 2 Mamunur Rashid, Wordpress 2 Classified Listing, Wordpress 2026-06-16 6.5 Medium
Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions.
CVE-2026-42659 2 Nasirahmed, Wordpress 2 Advanced Form Integration, Wordpress 2026-06-16 6.5 Medium
Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.
CVE-2026-49065 2 Hippooo, Wordpress 2 Hippoo Mobile App For Woocommerce, Wordpress 2026-06-16 8.2 High
Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.
CVE-2026-34886 2 Wordpress, Wp.insider 2 Wordpress, Simple Membership 2026-06-16 7.5 High
Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions.
CVE-2026-40782 2 Greg Winiarski, Wordpress 2 Wpadverts, Wordpress 2026-06-16 6.5 Medium
Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions.
CVE-2026-40788 2 Quantumcloud, Wordpress 2 Chatbot, Wordpress 2026-06-16 7.1 High
Subscriber Broken Access Control in ChatBot <= 7.9.7 versions.
CVE-2026-40794 2 Mycred, Wordpress 2 Mycred, Wordpress 2026-06-16 6.5 Medium
Subscriber Broken Access Control in myCred <= 3.0.3 versions.
CVE-2026-40774 2 Saasproject, Wordpress 2 Booking Package, Wordpress 2026-06-16 7.5 High
Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.
CVE-2026-48883 2 Wordpress, Wpclever 2 Wordpress, Wpc Product Bundles For Woocommerce 2026-06-16 7.5 High
Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions.
CVE-2026-40795 2026-06-16 6.5 Medium
Subscriber Broken Access Control in Amelia <= 2.2 versions.
CVE-2026-42666 2026-06-16 7.5 High
Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions.
CVE-2026-48887 2026-06-16 6.5 Medium
Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.
CVE-2026-49775 2026-06-16 6.5 Medium
Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.
CVE-2026-25425 2026-06-15 7.5 High
Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.
CVE-2026-49070 2026-06-15 7.5 High
Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions.
CVE-2026-53821 1 Openclaw 1 Openclaw 2026-06-15 8.8 High
OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operator.admin authority on live WebSocket connections to execute admin-gated Gateway RPCs.
CVE-2026-46716 1 Nezhahq 1 Nezha 2026-06-15 9.9 Critical
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbitrary Command. At every tick of the scheduler, the dashboard pushes that command to every server in the global ServerShared map — including servers that belong to other tenants (admin's servers, other members' servers). Each agent runs the command and returns the output, which is then sent to the attacker's own NotificationGroup → attacker-controlled webhook. This issue has been patched in version 2.0.8.
CVE-2026-48119 1 Nezhahq 1 Nezha 2026-06-15 7.1 High
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.12, authenticated agents can forge service-monitor results for other users' services. This issue has been patched in version 2.0.12.