Search

Expected end of text, found '/' (at char 28), (line:1, col:29)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (394962 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-91713 1 Google 1 Chrome 2026-09-17 4.2 Medium
Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
CVE-2026-91712 2 Apple, Google 2 Macos, Chrome 2026-09-17 8.3 High
Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-91711 1 Google 1 Chrome 2026-09-17 8.8 High
Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-91710 1 Google 1 Chrome 2026-09-17 9.6 Critical
Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-91709 1 Google 1 Chrome 2026-09-17 8.8 High
Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)
CVE-2026-91708 1 Google 1 Chrome 2026-09-17 3.1 Low
Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-66572 2026-09-17 6.5 Medium
Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.
CVE-2026-66577 2026-09-17 6.5 Medium
Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions.
CVE-2026-66579 2026-09-17 6.5 Medium
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions.
CVE-2026-78528 2026-09-17 5.3 Medium
Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions.
CVE-2026-78294 2026-09-17 6.5 Medium
Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
CVE-2026-74002 2026-09-17 5.3 Medium
Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.
CVE-2026-73999 2026-09-17 5.4 Medium
Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.
CVE-2026-66630 2026-09-17 7.6 High
Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.
CVE-2026-66626 2026-09-17 7.6 High
Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions.
CVE-2026-66619 2026-09-17 7.6 High
Administrator SQL Injection in Newsletters <= 4.18 versions.
CVE-2026-66617 2026-09-17 6.5 Medium
Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions.
CVE-2026-66574 2026-09-17 6.5 Medium
Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.
CVE-2026-62104 2026-09-17 10 Critical
Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions.
CVE-2026-92918 2026-09-17 8.8 High
admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access.