Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (7923 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-27338 2 Aivahthemes, Wordpress 2 Car Zone, Wordpress 2026-03-09 8.8 High
Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7.
CVE-2018-25164 1 Phpmassmail 1 Eversync 2026-03-09 7.5 High
EverSync 0.5 contains an arbitrary file download vulnerability that allows unauthenticated attackers to access sensitive files by requesting them directly from the files directory. Attackers can send GET requests to the files directory to download database files like db.sq3 containing application data and credentials.
CVE-2026-21786 2 Hclsoftware, Hcltech 2 Sametime For Ios, Sametime 2026-03-09 3.3 Low
HCL Sametime for iOS is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URLs.
CVE-2026-29128 2 Datacast, International Datacasting Corporation 3 Sfx2100, Sfx2100 Firmware, Sfx2100 Satellite Receiver 2026-03-09 10.0 Critical
IDC SFX2100 Satellite Receiver firmware ships with multiple daemon configuration files for routing components (e.g., zebra, bgpd, ospfd, and ripd) that are owned by root but world-readable. The configuration files (e.g., zebra.conf, bgpd.conf, ospfd.conf, ripd.conf) contain hardcoded or otherwise insecure plaintext passwords (including “enable”/privileged-mode credentials). A remote actor is able to abuse the reuse/hardcoded nature of these credentials to further access other systems in the network, gain a foothold on the satellite receiver or potentially locally privilege escalate.
CVE-2026-27369 2 Boldthemes, Wordpress 2 Celeste, Wordpress 2026-03-09 8.1 High
Deserialization of Untrusted Data vulnerability in BoldThemes Celeste celeste allows Object Injection.This issue affects Celeste: from n/a through <= 1.3.6.
CVE-2025-15318 1 Tanium 3 End-user Notifications, End-user Notifications Endpoint Tools, Endpoint End-user-notifications 2026-03-09 5.1 Medium
Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools.
CVE-2025-15319 1 Tanium 2 Endpoint Patch, Patch Endpoint Tools 2026-03-09 7.8 High
Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools.
CVE-2025-15543 1 Tp-link 2 Vx800v, Vx800v Firmware 2026-03-09 4.6 Medium
Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an attacker with physical access read‑only access to system files.
CVE-2025-15541 1 Tp-link 2 Vx800v, Vx800v Firmware 2026-03-09 6.3 Medium
Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic links to access system files, resulting in high confidentiality impact and limited integrity risk.
CVE-2026-27770 1 Epower 1 Epower.ie 2026-03-09 6.5 Medium
Charging station authentication identifiers are publicly accessible via web-based mapping platforms.
CVE-2026-22453 2 Themerex, Wordpress 2 Pets Club, Wordpress 2026-03-09 9.8 Critical
Deserialization of Untrusted Data vulnerability in ThemeREX Pets Club petclub allows Object Injection.This issue affects Pets Club: from n/a through <= 2.3.
CVE-2026-22451 2 Ancorathemes, Wordpress 2 Handyman, Wordpress 2026-03-09 9.8 Critical
Deserialization of Untrusted Data vulnerability in AncoraThemes Handyman handyman-services allows Object Injection.This issue affects Handyman: from n/a through <= 1.4.
CVE-2026-22417 2 Themegoods, Wordpress 2 Grand Wedding, Wordpress 2026-03-09 8.1 High
Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Wedding grandwedding allows Object Injection.This issue affects Grand Wedding: from n/a through <= 3.1.0.
CVE-2026-27379 2 Nextscripts, Wordpress 2 Nextscripts, Wordpress 2026-03-09 8.8 High
Deserialization of Untrusted Data vulnerability in NextScripts NextScripts social-networks-auto-poster-facebook-twitter-g allows Object Injection.This issue affects NextScripts: from n/a through <= 4.4.7.
CVE-2026-22475 2 Axiomthemes, Wordpress 2 Estate, Wordpress 2026-03-09 9.8 Critical
Deserialization of Untrusted Data vulnerability in axiomthemes Estate estate allows Object Injection.This issue affects Estate: from n/a through <= 1.3.4.
CVE-2026-22473 2 Designthemes, Wordpress 2 Dental Clinic, Wordpress 2026-03-09 8.8 High
Deserialization of Untrusted Data vulnerability in designthemes Dental Clinic dental allows Object Injection.This issue affects Dental Clinic: from n/a through <= 3.7.
CVE-2026-27438 2 Themerex, Wordpress 2 Kingler, Wordpress 2026-03-09 9.8 Critical
Deserialization of Untrusted Data vulnerability in ThemeREX Kingler kingler allows Object Injection.This issue affects Kingler: from n/a through <= 1.7.
CVE-2026-23798 2 Blubrry, Wordpress 2 Powerpress Podcasting, Wordpress 2026-03-09 8.8 High
Deserialization of Untrusted Data vulnerability in blubrry PowerPress Podcasting powerpress allows Object Injection.This issue affects PowerPress Podcasting: from n/a through <= 11.15.10.
CVE-2026-22501 2 Axiomthemes, Wordpress 2 Mounthood, Wordpress 2026-03-09 9.8 Critical
Deserialization of Untrusted Data vulnerability in axiomthemes Mounthood mounthood allows Object Injection.This issue affects Mounthood: from n/a through <= 1.3.2.
CVE-2026-3422 2 E-excellence, Edetw 2 U-office Force, U-office Force 2026-03-09 9.8 Critical
U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content.