Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9222 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-58373 1 Cvat 1 Cvat 2026-06-30 4.3 Medium
CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_queryset that allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exploiting a missing check_object_permissions call on the parent_id query parameter of the quality reports API endpoint. Attackers can send requests with sequential integer parent_id values and distinguish between existing and non-existing reports via HTTP 500 versus HTTP 404 response differences, disclosing cross-organization report existence without returning report content.
CVE-2026-57498 1 Coollabsio 1 Coolify 2026-06-30 9.6 Critical
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any operation. However, multiple Livewire web UI components accept server_id and destination_uuid from URL query parameters without any team ownership validation, allowing cross-team resource deployment. This vulnerability is fixed in 4.0.0-beta.474.
CVE-2026-57954 1 Elide 1 Elide 2026-06-30 4.3 Medium
Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across all rows via both JSON:API and GraphQL read paths.
CVE-2026-56768 1 Haiwen 1 Seahub 2026-06-30 8.8 High
Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees.
CVE-2026-57340 2 Shoheitanaka, Wordpress 2 Japanized For Woocommerce, Wordpress 2026-06-29 6.5 Medium
Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions.
CVE-2026-57327 2 Mainwp, Wordpress 2 Mainwp, Wordpress 2026-06-29 6.3 Medium
Subscriber Broken Access Control in MainWP <= 6.1.1 versions.
CVE-2026-57332 2 Wordpress, Wpswings 2 Wordpress, Wallet System For Woocommerce 2026-06-29 7.1 High
Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions.
CVE-2026-57334 2 Wedevs, Wordpress 2 Wp User Frontend, Wordpress 2026-06-29 6.5 Medium
Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.
CVE-2025-63041 2 Codeamp, Wordpress 2 Forget About Shortcode Buttons, Wordpress 2026-06-29 5.4 Medium
Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.
CVE-2025-63078 2 Jetmonsters, Wordpress 2 Restaurant Menu By Motopress, Wordpress 2026-06-29 4.3 Medium
Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.
CVE-2025-63079 2 Bdthemes, Wordpress 2 Live Copy Paste For Elementor, Wordpress 2026-06-29 4.3 Medium
Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.
CVE-2025-64636 2 Rhewlif, Wordpress 2 Donation Thermometer, Wordpress 2026-06-29 5.3 Medium
Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.
CVE-2026-54835 2 Rustaurius, Wordpress 2 Five Star Restaurant Menu, Wordpress 2026-06-29 7.5 High
Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.
CVE-2026-54837 2 Syed Balkhi, Wordpress 2 Intranet & Private Site – All-in-one Intranet, Wordpress 2026-06-29 7.5 High
Unauthenticated Broken Access Control in Intranet &amp; Private Site &#8211; All-In-One Intranet <= 1.8.1 versions.
CVE-2026-54846 2 Akosglys, Wordpress 2 Syncee Premium Dropshipping & Wholesale, Wordpress 2026-06-29 7.5 High
Unauthenticated Broken Access Control in Syncee Premium Dropshipping &amp; Wholesale <= 1.0.27 versions.
CVE-2026-56025 2 Paymob, Wordpress 2 Paymob For Woocommerce, Wordpress 2026-06-29 7.5 High
Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.
CVE-2026-56038 2 Frisbii, Wordpress 2 Frisbii Pay, Wordpress 2026-06-29 8.8 High
Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.
CVE-2026-56063 2 Bplugins, Wordpress 2 Mailchimp Block, Wordpress 2026-06-29 8.3 High
Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.
CVE-2026-57323 2 Bplugins, Wordpress 2 Flash & Html5 Video, Wordpress 2026-06-29 5.8 Medium
Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.
CVE-2026-57430 2 Seopress Free, Wordpress 2 Seopress Pro, Wordpress 2026-06-29 4.3 Medium
Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.