Export limit exceeded: 383582 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (383582 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-78275 2026-08-27 6.8 Medium
Editor Arbitrary File Deletion in Fluent Boards Pro <= 2.0.11 versions.
CVE-2026-78274 2026-08-27 9.1 Critical
Editor Arbitrary File Upload in Fluent Boards Pro <= 2.0.11 versions.
CVE-2026-78273 2026-08-27 6.5 Medium
Subscriber Cross Site Scripting (XSS) in Fluent Boards Pro <= 2.0.11 versions.
CVE-2026-78271 2026-08-27 7.2 High
Editor Privilege Escalation in FluentCRM Pro <= 3.1.12 versions.
CVE-2026-32564 2026-08-27 8.5 High
Subscriber SQL Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions.
CVE-2026-32550 2026-08-27 8.5 High
Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions.
CVE-2026-32479 2026-08-27 9.3 Critical
Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.17 versions.
CVE-2026-80531 1 Linux 1 Linux Kernel 2026-08-27 7.8 High
In the Linux kernel, the following vulnerability has been resolved: xfs: avoid UAF on sc->tempip in xrep_tempfile_create LOLLM noticed a potential UAF if the tempfile creation code fails after it set sc->tempip. Fix that.
CVE-2026-47879 1 Spring 1 Spring Cloud Gateway 2026-08-27 7.7 High
Spring Cloud Gateway JsonToGrpcGatewayFilterFactory allows arbitrary Spring Resource locations for defining the proto descriptor. Spring Cloud Gateway 5.0.0 - 5.0.2 Spring Cloud Gateway 4.3.0 - 4.3.5 Spring Cloud Gateway 4.0.0 - 4.2.9 Spring Cloud Gateway 3.1.13 and earlier
CVE-2026-81277 2026-08-27 8.5 High
Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.
CVE-2026-80433 2026-08-27 7.5 High
Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.
CVE-2026-78288 2026-08-27 9.3 Critical
Unauthenticated SQL Injection in Beautiful Taxonomy Filters <= 2.4.6 versions.
CVE-2026-78283 2026-08-27 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions.
CVE-2026-78281 2026-08-27 7.1 High
Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions.
CVE-2026-78260 2026-08-27 9.3 Critical
Unauthenticated SQL Injection in Epayco <= 8.4.6 versions.
CVE-2026-78257 2026-08-27 8.8 High
Contributor PHP Object Injection in Booking and Rental Manager <= 2.7.5 versions.
CVE-2026-27330 2026-08-27 8.6 High
Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.
CVE-2026-81279 2026-08-27 5.4 Medium
Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.
CVE-2026-81579 1 Wibu-systems-ag 1 Wibukey 2026-08-27 8.8 High
In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system.
CVE-2026-74752 1 Linux 1 Linux Kernel 2026-08-27 9.8 Critical
In the Linux kernel, the following vulnerability has been resolved: sctp: validate cookie AUTH state before use When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then reach association consumers with lengths or identifiers that were never validated against the local backing arrays. A forged RANDOM length can cause out-of-bounds reads during key-vector construction. A forged HMAC identifier also caused a 32-byte write past a zero-length AUTH chunk, providing a primitive for a local privilege escalation chain. Validate the cookie's RANDOM, HMACS, and CHUNKS parameters at the cookie trust boundary before copying them into the association. Reject invalid types, malformed lengths, unsupported HMAC identifiers, HMAC lists without SHA1, and forbidden chunk ids.