Search

Expected end of text, found '\' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (340856 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-22500 2 Axiomthemes, Wordpress 2 M2 | Construction And Tools Store, Wordpress 2026-03-26 9.8 Critical
Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construction and Tools Store: from n/a through <= 1.1.2.
CVE-2026-22485 2 Ruhul080, Wordpress 2 My Album Gallery, Wordpress 2026-03-26 6.5 Medium
Missing Authorization vulnerability in Ruhul Amin My Album Gallery my-album-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Album Gallery: from n/a through <= 1.0.4.
CVE-2026-22480 2 Webtoffee, Wordpress 2 Product Feed For Woocommerce, Wordpress 2026-03-26 7.2 High
Deserialization of Untrusted Data vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Object Injection.This issue affects Product Feed for WooCommerce: from n/a through <= 2.3.3.
CVE-2025-32988 2 Gnu, Redhat 9 Gnutls, Ceph Storage, Discovery and 6 more 2026-03-26 6.5 Medium
A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.
CVE-2025-9907 1 Redhat 6 Ansible Automation Platform, Ansible Automation Platform Developer, Ansible Automation Platform Inside and 3 more 2026-03-26 6.7 Medium
A flaw was found in the Red Hat Ansible Automation Platform, Event-Driven Ansible (EDA) Event Stream API. This vulnerability allows exposure of sensitive client credentials and internal infrastructure headers via the test_headers field when an event stream is in test mode. The possible outcome includes leakage of internal infrastructure details, accidental disclosure of user or system credentials, privilege escalation if high-value tokens are exposed, and persistent sensitive data exposure to all users with read access on the event stream.
CVE-2026-25360 2 Rascals, Wordpress 2 Vex, Wordpress 2026-03-26 8.8 High
Deserialization of Untrusted Data vulnerability in rascals Vex vex allows Object Injection.This issue affects Vex: from n/a through < 1.2.9.
CVE-2026-25358 2 Rascals, Wordpress 2 Meloo, Wordpress 2026-03-26 8.8 High
Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through < 2.8.2.
CVE-2026-25032 2 Park Of Ideas, Wordpress 2 Ricky, Wordpress 2026-03-26 9.8 Critical
Deserialization of Untrusted Data vulnerability in park_of_ideas Ricky ricky allows Object Injection.This issue affects Ricky: from n/a through < 2.31.
CVE-2026-25030 2 Park Of Ideas, Wordpress 2 Goldish, Wordpress 2026-03-26 9.8 Critical
Deserialization of Untrusted Data vulnerability in park_of_ideas Goldish goldish allows Object Injection.This issue affects Goldish: from n/a through < 3.47.
CVE-2026-24989 2 Fantasticplugins, Wordpress 2 Sumo Affiliates Pro, Wordpress 2026-03-26 9.8 Critical
Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.
CVE-2026-24978 2 Nootheme, Wordpress 2 Jobica Core, Wordpress 2026-03-26 8.8 High
Deserialization of Untrusted Data vulnerability in NooTheme Jobica Core jobica-core allows Object Injection.This issue affects Jobica Core: from n/a through <= 1.4.1.
CVE-2026-24976 2 Nootheme, Wordpress 2 Organici Library, Wordpress 2026-03-26 8.8 High
Deserialization of Untrusted Data vulnerability in NooTheme Organici Library noo-organici-library allows Object Injection.This issue affects Organici Library: from n/a through <= 2.1.2.
CVE-2026-24974 2 Nootheme, Wordpress 2 Citilights, Wordpress 2026-03-26 8.8 High
Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1.
CVE-2026-24378 2 Metagauss, Wordpress 2 Eventprime, Wordpress 2026-03-26 9.8 Critical
Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: from n/a through <= 4.2.8.0.
CVE-2025-69347 2 Convers Lab, Wordpress 2 Wpsubscription, Wordpress 2026-03-26 8.5 High
Authorization Bypass Through User-Controlled Key vulnerability in Convers Lab WPSubscription subscription allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPSubscription: from n/a through <= 1.8.10.
CVE-2025-52204 1 Znuny 1 Znuny 2026-03-26 6.1 Medium
A Cross-Site Scripting (XSS) vulnerability exists in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter
CVE-2025-12708 1 Ibm 1 Concert 2026-03-26 6.2 Medium
IBM Concert 1.0.0 through 2.2.0 contains hard-coded credentials that could be obtained by a local user.
CVE-2025-36187 1 Ibm 1 Knowledge Catalog Standard Cartridge 2026-03-26 4.4 Medium
IBM Knowledge Catalog Standard Cartridge 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.1, 5.1.1, 5,1.2, 5.1.3, 5.2.0, 5.2.1 stores potentially sensitive information in log files that could be read by a local privileged user.
CVE-2025-14790 1 Ibm 1 Infosphere Information Server 2026-03-26 6.5 Medium
IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow an attacker to obtain sensitive information due to insufficiently protected credentials.
CVE-2026-1561 1 Ibm 1 Websphere Application Server 2026-03-26 5.4 Medium
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.3 IBM WebSphere Application Server Liberty is vulnerable to server-side request forgery (SSRF). This may allow remote attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks.