Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (15437 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-12473 1 Open Health Imaging Foundation 1 Dicom Web Viewer Framework 2026-06-26 8.2 High
Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.
CVE-2026-13318 2 Kubevirt, Redhat 3 Kubevirt, Container Native Virtualization, Openshift Virtualization 2026-06-26 6.4 Medium
A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api reads the target IP from vmi.Status.Interfaces[0].IP and passes it directly to net.Dial() without validation. For VMIs using non-masquerade network bindings (bridge or secondary-only), this IP is reported by the QEMU guest agent running inside the VM and is fully controllable by the VM owner. An attacker with kubevirt.io:edit permissions can create a VM with a modified guest agent that reports an arbitrary IP address, then request port-forward to establish a bidirectional TCP tunnel from virt-api's cluster-internal network position to any routable destination, bypassing NetworkPolicy isolation.
CVE-2026-30120 2 Remotion, Remotion-dev 2 Remotion, Remotion 2026-06-26 9.8 Critical
remotion-dev remotion v4.0.409 was discovered to contain a remote code execution (RCE) vulnerability.
CVE-2025-68713 1 Rakuten 1 Send Anywhere For Android 2026-06-26 8 High
An issue was discovered in Rakuten Send Anywhere (File Transfer) for Android (com.estmob.android.sendanywhere) 23.2.9. The vulnerability allows untrusted applications (with no permissions) to force arbitrary file downloads into the app's scoped storage. The resulting files appear in the application's trusted Received interface. These conditions establish a vector for arbitrary code execution if the payload is an APK file, or a denial-of-service condition through resource exhaustion from oversized transfers.
CVE-2026-50872 1 Fossar 1 Selfoss 2026-06-26 9.8 Critical
An issue in the loopback request handling component of fossar selfoss v2.20-SNAPSHOT allows attackers to execute arbitrary commands and obtain sensitive information via supplying a crafted HTTP request.
CVE-2026-50880 1 Youtransfer 1 Youtransfer 2026-06-26 9.8 Critical
An issue in the sendmail transport integration component of YouTransfer v1.0.6 allows attackers to execute arbitrary code via supplying a crafted request.
CVE-2026-50887 1 Shlink 1 Shlink 2026-06-26 9.1 Critical
A Server-Side Request Forgery (SSRF) in the automatic short URL title resolution component of shlink v5.0.1 allows attackers to scan internal resources via supplying a crafted longUrl.
CVE-2026-44932 1 Suse 1 Wicked 2026-06-26 8.8 High
Passing of unsanitized strings from DHCP replies into the wicked dhcp client before wicked 0.6.79 could be used by attackers operating a malicious DHCP server to execute code on the local machine.
CVE-2025-69105 2 Themerex, Wordpress 2 Modernee, Wordpress 2026-06-26 8.1 High
Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions.
CVE-2025-69112 2 Themerex, Wordpress 2 Planty, Wordpress 2026-06-26 8.1 High
Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.
CVE-2025-69113 2 Themerex, Wordpress 2 Nexio, Wordpress 2026-06-26 8.1 High
Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.
CVE-2025-69114 2 Themerex, Wordpress 2 Maxinet, Wordpress 2026-06-26 8.1 High
Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions.
CVE-2025-69116 2 Themerex, Wordpress 2 Iona, Wordpress 2026-06-26 8.1 High
Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions.
CVE-2025-69118 2 Themerex, Wordpress 2 Copypress, Wordpress 2026-06-26 8.1 High
Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.
CVE-2025-69124 2 Themerex, Wordpress 2 Especio, Wordpress 2026-06-26 8.1 High
Unauthenticated Local File Inclusion in Especio <= 1.0 versions.
CVE-2025-69142 2 Themerex, Wordpress 2 Abelle, Wordpress 2026-06-26 8.1 High
Unauthenticated Local File Inclusion in Abelle <= 1.22 versions.
CVE-2025-69143 2 Themerex, Wordpress 2 Mission, Wordpress 2026-06-26 8.1 High
Unauthenticated Local File Inclusion in Mission <= 1.22 versions.
CVE-2025-69146 2 Themerex, Wordpress 2 Dom, Wordpress 2026-06-26 8.1 High
Unauthenticated Local File Inclusion in Dom <= 1.24 versions.
CVE-2025-69147 2 Themerex, Wordpress 2 Putter, Wordpress 2026-06-26 8.1 High
Unauthenticated Local File Inclusion in Putter <= 1.17 versions.
CVE-2025-69150 2 Themerex, Wordpress 2 Medeus, Wordpress 2026-06-26 8.1 High
Unauthenticated Local File Inclusion in Medeus <= 1.14 versions.