Export limit exceeded: 103169 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (103169 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-39729 2026-10-06 7.2 High
Unauthenticated Sensitive Data Exposure in Edwiser Bridge <= 4.3.4 versions.
CVE-2026-39728 2026-10-06 7.2 High
Unauthenticated Server Side Request Forgery (SSRF) in Instapage Plugin <= 3.7.2 versions.
CVE-2026-39726 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.
CVE-2026-39724 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.
CVE-2026-39722 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.
CVE-2026-39720 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.
CVE-2026-39719 2026-10-06 7.2 High
Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.
CVE-2026-32581 2026-10-06 7.1 High
Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.
CVE-2026-32580 2026-10-06 7.5 High
Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.
CVE-2026-32578 2026-10-06 7.1 High
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
CVE-2026-32577 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.
CVE-2026-32575 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.
CVE-2026-32574 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Smart Forms <= 2.6.104 versions.
CVE-2026-32572 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.
CVE-2026-32570 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.
CVE-2026-32569 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
CVE-2026-25434 2026-10-06 8.5 High
Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
CVE-2026-25433 2026-10-06 7.1 High
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
CVE-2026-105985 1 Craftcms 1 Cms 2026-10-06 8.8 High
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate(). This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process. The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required.
CVE-2026-105072 2026-10-06 7.5 High
Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.