Search

Expected end of text, found '/' (at char 52), (line:1, col:53)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (381469 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-73384 2 Cmsminds, Wordpress 2 Pay With Contact Form 7, Wordpress 2026-08-21 7.5 High
Unauthenticated Sensitive Data Exposure in Pay with Contact Form 7 <= 1.0.4 versions.
CVE-2026-73385 2 Outanking Team, Wordpress 2 Outranking Plugin Options, Wordpress 2026-08-21 7.5 High
Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.
CVE-2026-73387 2 Smartdatasoft, Wordpress 2 Resido, Wordpress 2026-08-21 8.1 High
Unauthenticated Local File Inclusion in Resido <= 1.5 versions.
CVE-2026-73389 2 The4, Wordpress 2 Kalles Addons, Wordpress 2026-08-21 9.8 Critical
Unauthenticated PHP Object Injection in Kalles Addons <= 1.0.6 versions.
CVE-2026-73390 2 Klbtheme, Wordpress 2 Total Donations, Wordpress 2026-08-21 9.8 Critical
Unauthenticated Privilege Escalation in Total Donations <= 2.0.5 versions.
CVE-2026-73391 2 Klbtheme, Wordpress 2 Total Donations, Wordpress 2026-08-21 9.3 Critical
Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.
CVE-2025-6032 1 Redhat 3 Enterprise Linux, Openshift, Rhel Eus 2026-08-21 8.3 High
A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.
CVE-2026-77066 1 Omnivore-app 1 Omnivore 2026-08-21 5 Medium
The scanFeedsResolver in packages/api/src/resolvers/subscriptions/index.ts passes the caller-supplied url straight to axios.get(url, rssParserConfig()) with no address validation. The same file guards the subscribe path with validateUrl(), which rejects private and reserved ranges through the private-ip library, and createPageSaveRequest applies the same check, so the omission is specific to this resolver. An authenticated user can direct the server to request arbitrary internal endpoints. The response is parsed as a feed or as HTML and the resolver returns the resulting url, title, description and type fields, so disclosure is limited to feed-shaped metadata and to link elements advertising RSS or Atom feeds; requests that do not parse still distinguish reachable ports from unreachable ones through the resulting error.
CVE-2026-77067 1 Omnivore-app 1 Omnivore 2026-08-21 5 Medium
The setWebhookResolver in packages/api/src/resolvers/webhooks/index.ts stores the caller-supplied url without any address validation, and the file imports no validation helper. When a subscribed event fires, callWebhook in packages/api/src/jobs/call_webhook.ts issues axios.request with that url, the method and Content-Type recorded on the webhook, and a JSON body carrying the event data, so an authenticated user can make the server send repeated attacker-shaped requests to internal endpoints, including link-local metadata addresses. The request is blind: callWebhook discards the result and writes only a success line or the axios error to the server log, so the response is not returned through the API.
CVE-2026-74021 2 Anders Norén, Wordpress 2 Chaplin, Wordpress 2026-08-21 7.5 High
Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.
CVE-2025-15637 2 Edge Themes, Wordpress 2 Shuffle, Wordpress 2026-08-21 8.1 High
Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.
CVE-2026-66590 2 Tagembed, Wordpress 2 Tagembed, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions.
CVE-2026-66594 2 Lukeseager, Wordpress 2 Wordpress Persistent Login, Wordpress 2026-08-21 8.5 High
Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions.
CVE-2026-66598 2 Kingtech Llc., Wordpress 2 B2bking Premium, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions.
CVE-2026-66605 2 Hasthemes, Wordpress 2 Swatchly – Woocommerce Variation Swatches For Products, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Swatchly – WooCommerce Variation Swatches for Products <= 1.4.13 versions.
CVE-2026-66606 2 Themegrill, Wordpress 2 Smartsmtp, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions.
CVE-2026-66609 2 Codexthemes, Wordpress 2 Thegem (elementor), Wordpress 2026-08-21 9.3 Critical
Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions.
CVE-2026-66647 2 Radiustheme, Wordpress 2 Homlisti, Wordpress 2026-08-21 6.5 Medium
Subscriber Broken Access Control in Homlisti <= 3.1.2 versions.
CVE-2026-66672 2 Monkeysan, Wordpress 2 Flatastic, Wordpress 2026-08-21 9.8 Critical
Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
CVE-2026-66673 2 Monkeysan, Wordpress 2 Flatastic, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.