Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (2888 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-12256 2026-06-17 8.8 High
Contributor PHP Object Injection in Avada <= 3.15.3 versions.
CVE-2026-39539 2026-06-17 8.1 High
Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.
CVE-2026-39554 2026-06-17 8.1 High
Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.
CVE-2026-39557 2 Elated-themes, Wordpress 2 Neobeat, Wordpress 2026-06-17 8.1 High
Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.
CVE-2026-39567 2026-06-17 8.1 High
Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.
CVE-2026-39577 2026-06-17 8.1 High
Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.
CVE-2026-39578 2026-06-17 8.1 High
Unauthenticated PHP Object Injection in Valiance <= 1.2 versions.
CVE-2026-39580 2026-06-17 8.1 High
Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.
CVE-2026-40739 2 Mikado-themes, Wordpress 2 Luxedrive, Wordpress 2026-06-17 8.1 High
Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.
CVE-2026-40751 2026-06-17 8.1 High
Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions.
CVE-2026-40754 2 Elated-themes, Wordpress 2 Roisin, Wordpress 2026-06-17 8.1 High
Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.
CVE-2026-40755 2026-06-17 8.1 High
Unauthenticated PHP Object Injection in TechLink <= 1.3 versions.
CVE-2026-40758 2026-06-17 8.1 High
Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.
CVE-2026-40759 2026-06-17 8.1 High
Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.
CVE-2026-48775 1 Langchain-ai 2 Langgraph, Langgraph-checkpoint 2026-06-16 6.8 Medium
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). In versions 4.1.0 and prior, the JsonPlusSerializer can reconstruct Python objects from JSON checkpoint payloads. Under conditions where someone could modify checkpoint bytes at rest in the backing store, the deserialization path could reconstruct objects beyond what the application expects, which could in turn result in code execution at checkpoint load time. This is a defense-in-depth issue. The affected behavior is reachable only when checkpoint bytes at rest in the backing store can be modified by an unauthorized party. In most deployments that prerequisite already implies a serious incident; the additional concern is turning "checkpoint-store write access" into code execution in the application runtime. This issue has been fixed in version 4.1.1.
CVE-2026-50589 1 Openstack 1 Ironic 2026-06-16 5.3 Medium
In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or JSON-RPC service and effect a service crash.
CVE-2026-10748 1 Sonatype 1 Nexus Repository Manager 2026-06-16 N/A
An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating system commands as the Nexus process user in Sonatype Nexus Repository 3 versions before 3.92.0.
CVE-2026-39481 2 Wordpress, Wpchill 2 Wordpress, Modula Image Gallery 2026-06-16 7.2 High
Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.
CVE-2026-27053 2026-06-16 9.8 Critical
Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions.
CVE-2026-39474 2 Metaphorcreations, Wordpress 2 Post Duplicator, Wordpress 2026-06-16 8.8 High
Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.