Search

Expected end of text, found 'ç' (at char 17), (line:1, col:18)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (380295 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-65517 2 Scott Paterson, Wordpress 2 Easy Paypal Buy Now Button, Wordpress 2026-08-07 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Easy PayPal Buy Now Button <= 2.0.4 versions.
CVE-2026-65523 2 Approveme, Wordpress 2 Formidable Forms Signature Online Contract Automation, Wordpress 2026-08-07 7.5 High
Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.
CVE-2026-65541 2 Solutioned, Wordpress 2 Staff Training, Wordpress 2026-08-07 7.3 High
Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.
CVE-2026-65542 2 Rajat Varlani, Wordpress 2 Super Socializer, Wordpress 2026-08-07 8.8 High
Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.
CVE-2026-65543 2 Vimeodev, Wordpress 2 Vimeo, Wordpress 2026-08-07 7.5 High
Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.
CVE-2026-65544 2 Rajat Varlani, Wordpress 2 Super Socializer, Wordpress 2026-08-07 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.
CVE-2026-65546 2 Qode, Wordpress 2 Qode Tours, Wordpress 2026-08-07 9.3 Critical
Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.
CVE-2026-65553 2 Wbolt.com, Wordpress 2 Spider Analyser – Wordpress搜索引擎蜘蛛分析插件, Wordpress 2026-08-07 10 Critical
Unauthenticated Remote Code Execution (RCE) in Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.
CVE-2026-65554 2 Lattepress, Wordpress 2 Anspress – Question And Answer, Wordpress 2026-08-07 7.1 High
Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.
CVE-2026-65556 2 Mihche, Wordpress 2 Wpbruiser {no- Captcha Anti-spam}, Wordpress 2026-08-07 9.8 Critical
Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.
CVE-2026-65571 2 Axiomthemes, Wordpress 2 69 Clothing, Wordpress 2026-08-07 9.8 Critical
Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
CVE-2026-65572 2 Axiomthemes, Wordpress 2 A.williams, Wordpress 2026-08-07 9.8 Critical
Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.
CVE-2026-66665 2 Brandexponents, Wordpress 2 Type Hub, Wordpress 2026-08-07 10 Critical
Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.
CVE-2026-66681 2 Jeff Farthing, Wordpress 2 Theme My Login, Wordpress 2026-08-07 4.3 Medium
Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.
CVE-2026-66683 2 Wordpress, Wp Zone 2 Wordpress, Custom Css And Javascript 2026-08-07 5.3 Medium
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.
CVE-2026-66685 2 Alex, Wordpress 2 Featured Video Plus, Wordpress 2026-08-07 5.3 Medium
Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.
CVE-2026-66686 2 Vladimir Garagulya, Wordpress 2 Plugins Garbage Collector (database Cleanup), Wordpress 2026-08-07 6.5 Medium
Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.
CVE-2026-66696 2 Nexcess, Wordpress 2 Gutenberg Blocks By Kadence Blocks, Wordpress 2026-08-07 4.3 Medium
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.
CVE-2026-53977 1 Bohdan Triapitsyn 1 Openchamber 2026-08-07 7.5 High
OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler chain. Attackers can exploit the route registration order in bootstrap-runtime.js to reach the shutdown handler before auth middleware executes, causing denial of service to all active AI coding sessions and locking out legitimate remote users regardless of whether UI_PASSWORD is configured.
CVE-2026-53985 1 Efstratios Goudelis 1 Ground Station 2026-08-07 7.5 High
Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restart_service command. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the service_control event to terminate all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers, with repeated triggering possible in Docker deployments to create a persistent denial-of-service condition.