Search

Expected end of text, found ':' (at char 25), (line:1, col:26)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (373203 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-73391 2 Klbtheme, Wordpress 2 Total Donations, Wordpress 2026-08-21 9.3 Critical
Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.
CVE-2025-6032 1 Redhat 3 Enterprise Linux, Openshift, Rhel Eus 2026-08-21 8.3 High
A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
CVE-2026-77067 1 Omnivore-app 1 Omnivore 2026-08-21 5 Medium
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.ts issues axios.request with that url, the method and Content-Type recorded on the webhook, and a JSON body carrying the event data, so an authenticated user can make the server send repeated attacker-shaped requests to internal endpoints, including link-local metadata addresses. The request is blind: callWebhook discards the result and writes only a success line or the axios error to the server log, so the response is not returned through the API.
CVE-2026-74021 2 Anders Norén, Wordpress 2 Chaplin, Wordpress 2026-08-21 7.5 High
Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.
CVE-2025-15637 2 Edge Themes, Wordpress 2 Shuffle, Wordpress 2026-08-21 8.1 High
Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.
CVE-2026-66590 2 Tagembed, Wordpress 2 Tagembed, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.
CVE-2026-66594 2 Lukeseager, Wordpress 2 Wordpress Persistent Login, Wordpress 2026-08-21 8.5 High
Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.
CVE-2026-66598 2 Kingtech Llc., Wordpress 2 B2bking Premium, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.
CVE-2026-66605 2 Hasthemes, Wordpress 2 Swatchly – Woocommerce Variation Swatches For Products, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.
CVE-2026-66606 2 Themegrill, Wordpress 2 Smartsmtp, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.
CVE-2026-66609 2 Codexthemes, Wordpress 2 Thegem (elementor), Wordpress 2026-08-21 9.3 Critical
Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.
CVE-2026-66647 2 Radiustheme, Wordpress 2 Homlisti, Wordpress 2026-08-21 6.5 Medium
Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.
CVE-2026-66672 2 Monkeysan, Wordpress 2 Flatastic, Wordpress 2026-08-21 9.8 Critical
Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
CVE-2026-66673 2 Monkeysan, Wordpress 2 Flatastic, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.
CVE-2026-66677 2 Vaultdweller, Wordpress 2 Leyka, Wordpress 2026-08-21 7.6 High
Subscriber Broken Authentication in Leyka <= 3.32.3 versions.
CVE-2026-68564 2 Notificationx, Wordpress 2 Notificationx Pro, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions.
CVE-2026-73998 2 Axew3, Wordpress 2 Wp W3all Phpbb, Wordpress 2026-08-21 8.5 High
Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions.
CVE-2026-74013 2 Wordpress, Wordpress.com 2 Wordpress, Eshipper Commerce 2026-08-21 8.5 High
Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions.
CVE-2026-74014 2 Indithemes, Wordpress 2 It Residence, Wordpress 2026-08-21 9.9 Critical
Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions.
CVE-2026-74016 2 Themagnifico52, Wordpress 2 Smart Cleaning, Wordpress 2026-08-21 9.9 Critical
Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions.