Search

Expected end of text, found 'łace' (at char 35), (line:1, col:36)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (385750 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-51618 1 Totolink 1 T6 2026-09-02 7.5 High
Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51622 1 Totolink 1 T6 2026-09-02 9.1 Critical
Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51631 1 Totolink 1 T6 2026-09-02 4.3 Medium
Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51694 1 Totolink 1 T6 2026-09-02 7.5 High
Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to add or change static DHCP rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-84144 1 Mozilla 1 Firefox 2026-09-02 N/A
Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2.
CVE-2026-23591 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23590 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23589 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23588 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23587 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23586 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23585 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23584 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23583 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-75411 1 Jeecgboot 1 Jeecgboot 2026-09-02 9.8 Critical
JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection.
CVE-2025-7963 2026-09-02 6.4 Medium
The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywaveformplayer() function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-26897 2026-09-02 9.8 Critical
An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component
CVE-2026-30073 1 Free5gc 1 Free5gc 2026-09-02 7.5 High
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2026-30612 2026-09-02 9.8 Critical
An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components
CVE-2026-51614 1 Totolink 1 T6 2026-09-02 4.3 Medium
Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain access-device policy and client state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.