Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (386193 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-81295 2026-09-03 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions.
CVE-2026-84238 2026-09-03 9.8 Critical
Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.
CVE-2026-81773 2026-09-03 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.
CVE-2026-84848 2026-09-03 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions.
CVE-2026-84847 2026-09-03 7.5 High
Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.
CVE-2026-84812 2026-09-03 7.1 High
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.
CVE-2026-84778 2026-09-03 7.5 High
Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration &amp; Cloning <= 6.65 versions.
CVE-2026-84776 2026-09-03 7.5 High
Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions.
CVE-2026-84769 2026-09-03 6.5 Medium
Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions.
CVE-2026-84767 2026-09-03 5.3 Medium
Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.
CVE-2026-84758 2026-09-03 6.5 Medium
Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.
CVE-2026-84754 2026-09-03 6.5 Medium
Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.
CVE-2026-84753 2026-09-03 9.8 Critical
Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
CVE-2026-81776 2026-09-03 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions.
CVE-2026-81282 2026-09-03 6.5 Medium
Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions.
CVE-2026-81281 2026-09-03 6.5 Medium
Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.
CVE-2026-51689 1 Totolink 1 T6 2026-09-03 9.1 Critical
Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-84963 1 Mongodb 1 C Driver 2026-09-03 5.3 Medium
An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value to be silently shortened, or the corresponding field to be omitted, while the parsing operation still reports success and returns no error. An unauthenticated party who can supply the input processed by an application that uses this component may cause that application to hold data that does not match what was submitted, which may result in unintended alteration of data.
CVE-2026-84962 1 Mongodb 1 Libmongocrypt 2026-09-03 4.2 Medium
An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.
CVE-2026-71963 1 Nousresearch 1 Hermes-agent 2026-09-03 8.8 High
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute arbitrary OS commands by supplying a malicious repository with a crafted .git/config that sets core.fsmonitor to an attacker-controlled command. When a user opens the malicious repository and sends any message, the agent triggers a git status index refresh which executes the injected command in the user's process context, exposing the full environment including configured provider API keys.