Export limit exceeded: 372965 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (90675 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-12493 2026-07-27 7.5 High
The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the WooCommerce order being completed, nor that the paid amount matches the order total, allowing unauthenticated users to mark arbitrary orders as paid by replaying a single genuinely-approved payment reference (for example one obtained from their own minimal purchase).
CVE-2026-63765 1 Chatwoot 1 Chatwoot 2026-07-27 8.2 High
Chatwoot before 4.16.0 contains an authentication bypass vulnerability in the direct uploads controller that allows unauthenticated attackers to create arbitrary ActiveStorage blobs in any tenant account. Attackers can exploit missing authentication checks to resolve any account and conversation, then obtain signed PUT URLs to write arbitrary data to the application's storage backend.
CVE-2026-16384 1 Mozilla 1 Firefox 2026-07-27 7.5 High
Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16398 1 Mozilla 1 Firefox 2026-07-27 7.5 High
Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16400 1 Mozilla 1 Firefox 2026-07-27 7.5 High
Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-16404 1 Mozilla 1 Firefox 2026-07-27 7.4 High
Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153.
CVE-2026-16409 1 Mozilla 1 Firefox 2026-07-27 7.5 High
Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153.
CVE-2026-59534 2 Aurovrata Venet, Wordpress 2 Post My Cf7 Form, Wordpress 2026-07-27 7.5 High
Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.
CVE-2026-59546 2 John Darrel, Wordpress 2 Hide My Wp Ghost, Wordpress 2026-07-27 7.4 High
Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions.
CVE-2026-59553 2 Rextheme, Wordpress 2 Product Feed Manager, Wordpress 2026-07-27 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions.
CVE-2026-66427 2 Jgwhite33, Wordpress 2 Wp Google Review Slider, Wordpress 2026-07-27 7.6 High
Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.
CVE-2026-12255 2026-07-27 8.1 High
The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request.
CVE-2026-59686 1 Progress 4 Ecs Connection Manager, Loadmaster, Moveit Waf and 1 more 2026-07-27 8.4 High
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise.
CVE-2026-59687 1 Progress 4 Ecs Connection Manager, Loadmaster, Moveit Waf and 1 more 2026-07-27 8.4 High
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise.
CVE-2026-59688 1 Progress 4 Ecs Connection Manager, Loadmaster, Moveit Waf and 1 more 2026-07-27 8.4 High
An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise.
CVE-2026-59528 2 Shiptime, Wordpress 2 Shiptime: Discounted Shipping Rates, Wordpress 2026-07-27 7.5 High
Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions.
CVE-2026-59530 2 Paymentplugins, Wordpress 2 Stripe For Woocommerce, Wordpress 2026-07-27 7.5 High
Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.
CVE-2026-57396 2 Flintop, Wordpress 2 Free Gifts For Woocommerce, Wordpress 2026-07-27 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flintop Free Gifts for WooCommerce free-gifts-for-woocommerce allows Stored XSS.This issue affects Free Gifts for WooCommerce: from n/a through <= 13.1.0.
CVE-2026-57705 2 Nexcess, Wordpress 2 Event Tickets, Wordpress 2026-07-27 7.5 High
Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5.
CVE-2026-57787 2 Creativews, Wordpress 2 Cws Svgicons, Wordpress 2026-07-27 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeWS CWS SVGicons cws-svgicons allows Blind SQL Injection.This issue affects CWS SVGicons: from n/a through <= 1.5.5.