Search

Expected end of text, found ':' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (327720 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-0889 1 Mozilla 1 Firefox 2026-01-14 7.5 High
Denial-of-service in the DOM: Service Workers component. This vulnerability affects Firefox < 147.
CVE-2025-71027 1 Tenda 1 Ax3 2026-01-14 N/A
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanMTU2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2026-0684 2 Codepeople, Wordpress 2 Cp Image Store With Slideshow, Wordpress 2026-01-14 4.3 Medium
The CP Image Store with Slideshow plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.9 due to a logic error in the 'cpis_admin_init' function's permission check. This makes it possible for authenticated attackers, with Contributor-level access and above, to import arbitrary products via XML, if the XML file has already been uploaded to the server.
CVE-2025-13444 1 Progress 2 Loadmaster, Multi-tenant Loadmaster 2026-01-14 8.4 High
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
CVE-2025-71026 1 Tenda 1 Ax3 2026-01-14 N/A
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the wanSpeed2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2025-14507 2 Metagauss, Wordpress 2 Eventprime, Wordpress 2026-01-14 5.3 Medium
The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. This makes it possible for unauthenticated attackers to extract sensitive booking data including user names, email addresses, ticket details, payment information, and order keys when the API is enabled by an administrator. The vulnerability was partially patched in version 4.2.7.0.
CVE-2026-0890 1 Mozilla 2 Firefox, Firefox Esr 2026-01-14 6.5 Medium
Spoofing issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability affects Firefox < 147 and Firefox ESR < 140.7.
CVE-2025-65783 1 Hubert 1 Hub 2026-01-14 N/A
An arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows attackers to execute arbitrary code via uploading a crafted PDF file.
CVE-2026-0888 1 Mozilla 1 Firefox 2026-01-14 5.3 Medium
Information disclosure in the XML component. This vulnerability affects Firefox < 147.
CVE-2026-0883 1 Mozilla 2 Firefox, Firefox Esr 2026-01-14 5.3 Medium
Information disclosure in the Networking component. This vulnerability affects Firefox < 147 and Firefox ESR < 140.7.
CVE-2025-65784 1 Hubert 1 Hub 2026-01-14 N/A
Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows authenticated attackers with low-level privileges to access other users' information via a crafted API request.
CVE-2025-66698 1 Semantic 1 Machines 2026-01-14 8.6 High
An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints.
CVE-2026-0887 1 Mozilla 2 Firefox, Firefox Esr 2026-01-14 5.3 Medium
Clickjacking issue, information disclosure in the PDF Viewer component. This vulnerability affects Firefox < 147 and Firefox ESR < 140.7.
CVE-2025-25652 1 Eptura 1 Archibus 2026-01-14 N/A
In Eptura Archibus 2024.03.01.109, the "Run script" and "Server File" components of the "Database Update Wizard" are vulnerable to directory traversal.
CVE-2026-0881 1 Mozilla 1 Firefox 2026-01-14 10 Critical
Sandbox escape in the Messaging System component. This vulnerability affects Firefox < 147.
CVE-2025-69990 1 Phpgurukul 1 News Portal Project 2026-01-14 N/A
phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted.
CVE-2026-0878 1 Mozilla 2 Firefox, Firefox Esr 2026-01-14 8 High
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability affects Firefox < 147 and Firefox ESR < 140.7.
CVE-2025-71025 1 Tenda 1 Ax3 2026-01-14 N/A
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the cloneType2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.
CVE-2026-0891 1 Mozilla 4 Firefox, Firefox Esr, Thunderbird and 1 more 2026-01-14 8.1 High
Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 147 and Firefox ESR < 140.7.
CVE-2025-71023 1 Tenda 1 Ax3 2026-01-14 7.5 High
Tenda AX-3 v16.03.12.10_CN was discovered to contain a stack overflow in the mac2 parameter of the fromAdvSetMacMtuWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted request.