Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (370450 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-59540 2026-07-23 9.8 Critical
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions.
CVE-2026-57384 2 Membershipsoftware, Wordpress 2 Wishlist Member X, Wordpress 2026-07-23 6.5 Medium
Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions.
CVE-2026-57735 2 Soflyy, Wordpress 2 Breakdance, Wordpress 2026-07-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions.
CVE-2026-57809 2 Affiliatewp, Wordpress 2 Affiliatewp, Wordpress 2026-07-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions.
CVE-2026-59524 2026-07-23 6.5 Medium
Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.
CVE-2026-61943 2026-07-23 7.5 High
Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.
CVE-2026-61950 2 Themetechmount, Wordpress 2 Truebooker, Wordpress 2026-07-23 9.3 Critical
Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.
CVE-2026-65449 2 Romancode, Wordpress 2 Mapsvg, Wordpress 2026-07-23 6.5 Medium
Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.
CVE-2026-65468 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.
CVE-2026-65481 2026-07-23 7.5 High
Contributor Local File Inclusion in Vino <= 1.9 versions.
CVE-2026-65487 2 Themegoods, Wordpress 2 Photography, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.
CVE-2026-65493 2026-07-23 7.5 High
Subscriber PHP Object Injection in Dokan Pro <= 5.0.2 versions.
CVE-2026-60187 1 Oracle 2 Mysql Cluster, Mysql Server 2026-07-23 4.4 Medium
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-65499 2026-07-23 6.5 Medium
Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.
CVE-2026-65510 2026-07-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.
CVE-2026-65519 2 Gt3themes, Wordpress 2 Photo Gallery, Wordpress 2026-07-23 6.5 Medium
Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.
CVE-2026-65533 2026-07-23 6.5 Medium
Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.
CVE-2026-15037 1 Qt 1 Qt 2026-07-23 N/A
Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.
CVE-2026-65465 2026-07-23 6.5 Medium
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.
CVE-2026-13753 1 Hp 1 Hp 2800 Printer Series 2026-07-23 7.5 High
A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version <=TBP1CN2612AR. An unauthenticated attacker with network access can send GET requests to multiple exposed administrative API endpoints and retrieve sensitive configuration data such as plaintext Wi‑Fi Direct credentials, unique device identity information, and other administrative security state details. When accessed through the web interface, these setting pages explicitly require administrator credentials before sensitive information is displayed.