Search

Expected end of text, found '.' (at char 19), (line:1, col:20)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (342216 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-22729 1 Vmware 2 Spring, Spring Ai 2026-04-02 8.6 High
A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents. This vulnerability affects applications using vector stores that extend AbstractFilterExpressionConverter for multi-tenant isolation, role-based access control, or document filtering based on metadata. The vulnerability occurs when user-supplied values in filter expressions are not escaped before being inserted into JSONPath queries. Special characters like ", ||, and && are passed through unescaped, allowing injection of arbitrary JSONPath logic that can alter the intended query semantics.
CVE-2026-32565 2 Webberzone, Wordpress 2 Contextual Related Posts, Wordpress 2026-04-02 N/A
Missing Authorization vulnerability in Ajay Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contextual Related Posts: from n/a through < 4.2.2.
CVE-2026-25449 2 Shinetheme, Wordpress 2 Traveler, Wordpress 2026-04-02 N/A
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.
CVE-2026-27093 2 Ovatheme, Wordpress 2 Tripgo, Wordpress 2026-04-02 N/A
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Tripgo tripgo allows PHP Local File Inclusion.This issue affects Tripgo: from n/a through < 1.5.6.
CVE-2026-27091 2 Uipress, Wordpress 2 Uipress Lite, Wordpress 2026-04-02 N/A
Missing Authorization vulnerability in UiPress UiPress lite uipress-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UiPress lite: from n/a through <= 3.5.09.
CVE-2026-25471 2 Themepaste, Wordpress 2 Admin Safety Guard, Wordpress 2026-04-02 N/A
Authentication Bypass Using an Alternate Path or Channel vulnerability in Themepaste Admin Safety Guard admin-safety-guard allows Password Recovery Exploitation.This issue affects Admin Safety Guard: from n/a through <= 1.2.6.
CVE-2026-25312 2 Theeventprime, Wordpress 2 Eventprime, Wordpress 2026-04-02 N/A
Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through <= 4.2.8.3.
CVE-2025-32223 2 Themeum, Wordpress 2 Tutor Lms, Wordpress 2026-04-02 N/A
Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.4.
CVE-2025-50001 2 Tagdiv, Wordpress 2 Tagdiv Composer, Wordpress 2026-04-02 N/A
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows Reflected XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.2.
CVE-2025-53222 2 Tagdiv, Wordpress 2 Opt In Builder, Wordpress 2026-04-02 N/A
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Opt-In Builder td-subscription allows Reflected XSS.This issue affects tagDiv Opt-In Builder: from n/a through <= 1.7.3.
CVE-2026-25438 2 Themehunk, Wordpress 2 Gutenberg Blocks, Wordpress 2026-04-02 N/A
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk Gutenberg Blocks unlimited-blocks allows Reflected XSS.This issue affects Gutenberg Blocks: from n/a through <= 1.2.8.
CVE-2026-25442 2 Qantumthemes, Wordpress 2 Kentha, Wordpress 2026-04-02 N/A
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QantumThemes Kentha kentha allows Reflected XSS.This issue affects Kentha: from n/a through <= 4.7.2.
CVE-2026-25443 2 Dotstore, Wordpress 2 Fraud Prevention For Woocommerce, Wordpress 2026-04-02 N/A
Missing Authorization vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fraud Prevention For Woocommerce: from n/a through <= 2.3.3.
CVE-2026-27065 2 Thimpress, Wordpress 2 Builderpress, Wordpress 2026-04-02 N/A
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress BuilderPress builderpress allows PHP Local File Inclusion.This issue affects BuilderPress: from n/a through <= 2.0.1.
CVE-2026-27067 2 Syarif, Wordpress 2 Mobile App Editor, Wordpress 2026-04-02 N/A
Unrestricted Upload of File with Dangerous Type vulnerability in Syarif Mobile App Editor mobile-app-editor allows Upload a Web Shell to a Web Server.This issue affects Mobile App Editor: from n/a through <= 1.3.1.
CVE-2026-27068 2 Ryan Howard, Wordpress 2 Website Llms.txt, Wordpress 2026-04-02 N/A
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Howard Website LLMs.txt website-llms-txt allows Reflected XSS.This issue affects Website LLMs.txt: from n/a through <= 8.2.6.
CVE-2026-27043 2 Themegoods, Wordpress 2 Photography, Wordpress 2026-04-02 N/A
Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGoods Photography photography allows Path Traversal.This issue affects Photography: from n/a through <= 7.7.5.
CVE-2026-23658 1 Microsoft 2 Azure Devops, Azure Devops Msazure 2026-04-02 8.6 High
Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-26120 1 Microsoft 1 Bing 2026-04-02 6.5 Medium
Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to perform tampering over a network.
CVE-2026-23659 1 Microsoft 1 Azure Data Factory 2026-04-02 8.6 High
Exposure of sensitive information to an unauthorized actor in Azure Data Factory allows an unauthorized attacker to disclose information over a network.