Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (84922 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-5233 1 Mia Technology 1 Pizzy Library 2026-06-23 7.1 High
Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. Pizzy Library allows Flooding. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.
CVE-2026-5242 1 Mia Technology 1 Pizzy Library 2026-06-23 8.8 High
Improper neutralization of formula elements in a CSV file vulnerability in MIA Technology Inc. Pizzy Library allows Code Injection. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.
CVE-2026-49062 2 Wordpress, Wp Engine 2 Wordpress, Faust.js 2026-06-23 8.8 High
Authentication Bypass Using an Alternate Path or Channel vulnerability in WP Engine Faust.Js allows Password Recovery Exploitation. This issue affects Faust.Js: from n/a through 1.8.7.
CVE-2026-49064 2 Stiofan, Wordpress 2 Getpaid, Wordpress 2026-06-23 7.5 High
Insertion of Sensitive Information Into Sent Data vulnerability in Stiofan GetPaid allows Retrieve Embedded Sensitive Data. This issue affects GetPaid: from n/a through 2.8.49.
CVE-2026-5079 2 Expressjs, Multer 2 Multer, Multer 2026-06-23 7.5 High
Impact: multer versions 1.0.0 through 2.1.1 and 3.0.0-alpha.1 are vulnerable to a Denial of Service via deeply nested field names in multipart form data. The append-field dependency parses bracket notation in field names with no limit on nesting depth, allowing an attacker to force allocation of deeply nested object structures that consume CPU and memory. A single HTTP request with a crafted multipart body is sufficient to exploit this. Patches: Users should upgrade to multer 2.2.0 (2.x line) or 3.0.0-alpha.2 (3.x prerelease) and configure the new limits.fieldNestingDepth option to the minimum depth their application requires. Workarounds: Set limits.fields to a reasonable value to reduce the number of fields an attacker can send per request. This does not fully mitigate the issue but limits the impact.
CVE-2026-9863 1 Fortra 1 Core Privileged Access Manager (boks) 2026-06-23 7.5 High
Fortra BoKS Manager contains an OS command injection vulnerability in the client upgrade and patch tooling for legacy tar-based client installations. A malicious or compromised legacy tar-installed client selected for upgrade or patching may be able to cause commands to be executed on the BoKS Master during client version handling.
CVE-2025-68840 2 Markbeljaars, Wordpress 2 Irobots.txt Seo, Wordpress 2026-06-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.
CVE-2025-68851 2 Arrayhq, Wordpress 2 Okay Toolkit, Wordpress 2026-06-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions.
CVE-2025-68872 2 Eli, Wordpress 2 Eli's Wordcents Adsense Widget With Analytics, Wordpress 2026-06-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Eli&#039;s WordCents adSense Widget with Analytics <= 1.3.03.27 versions.
CVE-2026-25425 2 Themegrill, Wordpress 2 User Registration, Wordpress 2026-06-23 7.5 High
Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.
CVE-2026-34898 2 Wordpress, Wp Swings 2 Wordpress, Event Tickets Manager For Woocommerce 2026-06-23 7.5 High
Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions.
CVE-2026-39498 2 Wordpress, Yeeaddons 2 Wordpress, Yaymail 2026-06-23 7.2 High
Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.
CVE-2026-39507 2 Themeisle, Wordpress 2 Social Slider Feed, Wordpress 2026-06-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.
CVE-2026-39587 2 Hakan Ozevin, Wordpress 2 Wp Base Booking, Wordpress 2026-06-23 8.1 High
Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.
CVE-2026-40741 2 Jose Conti, Wordpress 2 Redsys For Woocommerce Light, Wordpress 2026-06-23 7.5 High
Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 versions.
CVE-2026-40769 2 Satinder Singh, Wordpress 2 Contact Form Extender For Divi – Save Entries, File Upload & Country Code Field, Wordpress 2026-06-23 8.6 High
Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi &#8211; Save Entries, File Upload &amp; Country Code Field <= 1.0.6 versions.
CVE-2026-40775 2 Royal Plugins, Wordpress 2 Royal Mcp, Wordpress 2026-06-23 7.3 High
Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions.
CVE-2026-40776 2 Arraytics, Wordpress 2 Wp Event Solution, Wordpress 2026-06-23 7.5 High
Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.
CVE-2026-40785 2 Ruben Garcia, Wordpress 2 Automatorwp, Wordpress 2026-06-23 7.1 High
Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions.
CVE-2026-40789 2 Tms, Wordpress 2 Amelia, Wordpress 2026-06-23 7.5 High
Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions.