Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (40430 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-27399 2 Webwizards, Wordpress 2 Marketking, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.
CVE-2026-27422 2 Bplugins, Wordpress 2 Yt Player, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in YT Player <= 2.0.9 versions.
CVE-2026-57425 2 Wordpress, Wpdesk 2 Wordpress, Autopay Dla Woocommerce 2026-07-23 6.5 Medium
Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.
CVE-2026-59514 2 Mightynetworks Vs Buddyboss, Wordpress 2 Buddyboss Platform, Wordpress 2026-07-23 9.3 Critical
Unauthenticated SQL Injection in Buddyboss Platform <= 3.0.5 versions.
CVE-2026-61954 2 Payu India, Wordpress 2 Payu India, Wordpress 2026-07-23 7.5 High
Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.
CVE-2026-61972 2 Woolentor, Wordpress 2 Shoplentor Pro, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
CVE-2026-61973 2 Woolentor, Wordpress 2 Shoplentor Pro, Wordpress 2026-07-23 4.3 Medium
Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
CVE-2026-65457 2 Wordpress, Yoomoney 2 Wordpress, Юkassa Для Woocommerce 2026-07-23 4.3 Medium
Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.
CVE-2026-65472 2 Kit, Wordpress 2 Kit (formerly Convertkit), Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.
CVE-2026-65479 2 Mvp Themes, Wordpress 2 Reviewer, Wordpress 2026-07-23 5.4 Medium
Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.
CVE-2026-65485 2 Daniel Iser, Wordpress 2 Content Control, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.
CVE-2026-65486 2 Bastien Ho, Wordpress 2 Event Post, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.
CVE-2026-65500 2 Pixelacehq, Wordpress 2 Manual - Documentation, Knowledge Base & Education Wordpress Theme, Wordpress 2026-07-23 7.5 High
Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
CVE-2026-65524 2 Themefusion, Wordpress 2 Avada Custom Branding, Wordpress 2026-07-23 4.3 Medium
Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.
CVE-2026-65525 2 Uxper, Wordpress 2 Civi Framework, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.
CVE-2026-65537 2 Themeisle, Wordpress 2 Cyr To Lat Reloaded – Transliteration Of Links And File Names, Wordpress 2026-07-23 4.3 Medium
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.
CVE-2026-65450 2 Romancode, Wordpress 2 Mapsvg, Wordpress 2026-07-23 8.5 High
Contributor SQL Injection in MapSVG <= 8.14.0 versions.
CVE-2026-65594 1 N8n 1 N8n 2026-07-23 6.5 Medium
n8n before 2.29.8 and 2.30.x before 2.30.1 (affected from 2.27.0, when the OAuth 2.1 consent and token-issuance flow was introduced) does not verify that the authenticated user has access to the workflow referenced as the OAuth resource. On instances with at least one active MCP Server Trigger workflow configured with n8n OAuth2 authentication, a member-level user can register an OAuth client, self-approve consent for another user's workflow, and obtain a valid token. The workflow then runs in the owner's project context with the owner's stored credentials, and the attacker can set tool inputs and read outputs (potentially including data from the owner's connected integrations), breaking user and project isolation.
CVE-2026-13068 1 Mongodb 2 Mongodb, Mongodb Server 2026-07-23 4.2 Medium
An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace.
CVE-2026-13066 1 Mongodb 2 Mongodb, Mongodb Server 2026-07-23 6.5 Medium
Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript.