Export limit exceeded: 372966 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 372966 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 372966 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 24), (line:1, col:25)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (372966 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-76926 1 Wireshark 1 Wireshark 2026-08-20 3.1 Low
BUSMASTER file parser abnormal exit in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-76924 1 Wireshark 1 Wireshark 2026-08-20 5.5 Medium
Kerberos protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-76923 1 Wireshark 1 Wireshark 2026-08-20 5.5 Medium
Bluetooth HFP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-76918 1 Wireshark 1 Wireshark 2026-08-20 5.5 Medium
SSH protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-76917 1 Wireshark 1 Wireshark 2026-08-20 5.5 Medium
Bluetooth AVRCP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-76891 1 Wireshark 1 Wireshark 2026-08-20 3.1 Low
Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-76885 1 Wireshark 1 Wireshark 2026-08-20 3.1 Low
Tektronix K12xx file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-76880 1 Wireshark 1 Wireshark 2026-08-20 7.5 High
RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service
CVE-2026-75952 1 Cmsjunkie.com 1 J-businessdirectory Extension For Joomla 2026-08-20 N/A
Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions (app install, demo-data wipe, cache/statistics archive, payment notification send, mobile push). Frontend CSRF needs a registered/listing-owner session; admin CSRF needs a backend admin session.
CVE-2026-75114 2026-08-20 N/A
Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.
CVE-2026-74804 2026-08-20 N/A
Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.
CVE-2026-74803 2026-08-20 N/A
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.
CVE-2026-73390 2026-08-20 9.8 Critical
Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.
CVE-2026-73389 2026-08-20 9.8 Critical
Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.
CVE-2026-73385 2026-08-20 7.5 High
Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.
CVE-2026-73384 2026-08-20 7.5 High
Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.
CVE-2026-73347 2 Themetechmount, Wordpress 2 Truebooker, Wordpress 2026-08-20 9.8 Critical
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions.
CVE-2026-73185 2 Wordpress, Wpo-hr 2 Wordpress, Ngg Smart Image Search 2026-08-20 9.3 Critical
Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.
CVE-2026-71961 2026-08-20 8.8 High
Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.
CVE-2026-67364 2026-08-20 N/A
Joomla Extension - balbooa.com - Pre-auth PHP Code Injection in Balbooa Forms < 2.4.3.2 - CWE-94 / CWE-95 | CVSS 3.1: 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) The form's optional custom-PHP post-submission handler is executed via eval(). The [URL parameter = X] shortcode is substituted with the raw, unescaped value of a query parameter, letting an unauthenticated attacker inject arbitrary PHP that executes server-side. The CSRF token needed to reach the endpoint is itself disclosed anonymously via a separate task, so it provides no real protection. Exploitability requires the form to have a custom-PHP handler configured (a documented builder feature) referencing that shortcode, and no reCAPTCHA on the submit button.