Search

Expected end of text, found '.' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (330240 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-67945 3 Mailerlite, Woocommerce, Wordpress 3 Mailerlite, Woocommerce, Wordpress 2026-01-28 9.3 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in MailerLite MailerLite – WooCommerce integration woo-mailerlite allows SQL Injection.This issue affects MailerLite – WooCommerce integration: from n/a through <= 3.1.2.
CVE-2025-67944 2 Neliosoftware, Wordpress 2 Nelio Ab Testing, Wordpress 2026-01-28 9.1 Critical
Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through <= 8.1.8.
CVE-2025-67943 2 Wordpress, Wphocus 2 Wordpress, My Auctions Allegro 2026-01-28 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Reflected XSS.This issue affects My auctions allegro: from n/a through <= 3.6.32.
CVE-2025-67942 1 Wordpress 1 Wordpress 2026-01-28 6.5 Medium
Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through <= 3.3.6.
CVE-2025-63388 2 Dify, Langgenius 2 Dify, Dify 2026-01-28 9.1 Critical
A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any external domain to make authenticated cross-origin requests. NOTE: the Supplier disputes this, providing the rationale of "sending requests with credentials does not provide any additional access compared to unauthenticated requests."
CVE-2025-27063 1 Qualcomm 223 Csra6620, Csra6620 Firmware, Csra6640 and 220 more 2026-01-28 7.8 High
Memory corruption during video playback when video session open fails with time out error.
CVE-2025-47319 1 Qualcomm 237 Ar8035, Ar8035 Firmware, Fastconnect 6200 and 234 more 2026-01-28 6.7 Medium
Information disclosure while exposing internal TA-to-TA communication APIs to HLOS
CVE-2025-47322 1 Qualcomm 223 Ar8031, Ar8031 Firmware, Ar8035 and 220 more 2026-01-28 7.8 High
Memory corruption while handling IOCTL calls to set mode.
CVE-2026-24131 1 Pnpm 1 Pnpm 2026-01-28 5.5 Medium
pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `"directories": {"bin": "../../../../tmp"}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations. This issue only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`). Version 10.28.2 contains a patch.
CVE-2025-47323 1 Qualcomm 357 Ar8035, Ar8035 Firmware, Csra6620 and 354 more 2026-01-28 7.8 High
Memory corruption while routing GPR packets between user and root when handling large data packet.
CVE-2025-47330 1 Qualcomm 447 Ar8031, Ar8031 Firmware, Ar8035 and 444 more 2026-01-28 5.5 Medium
Transient DOS while parsing video packets received from the video firmware.
CVE-2025-47331 1 Qualcomm 599 Ar8031, Ar8031 Firmware, Ar8035 and 596 more 2026-01-28 6.1 Medium
Information disclosure while processing a firmware event.
CVE-2025-47333 1 Qualcomm 479 Aqt1000, Aqt1000 Firmware, Ar8031 and 476 more 2026-01-28 6.6 Medium
Memory corruption while handling buffer mapping operations in the cryptographic driver.
CVE-2026-1448 2 D-link, Dlink 3 Dir-615, Dir-615, Dir-615 Firmware 2026-01-28 7.2 High
A vulnerability was detected in D-Link DIR-615 up to 4.10. This impacts an unknown function of the file /wiz_policy_3_machine.php of the component Web Management Interface. Performing a manipulation of the argument ipaddr results in os command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-24525 2 Cloudpanel, Wordpress 2 Clp Varnish Cache, Wordpress 2026-01-28 5.3 Medium
Missing Authorization vulnerability in CloudPanel CLP Varnish Cache clp-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CLP Varnish Cache: from n/a through <= 1.0.2.
CVE-2025-69076 2 Ancorathemes, Wordpress 2 Modern Housewife, Wordpress 2026-01-28 8.1 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Modern Housewife modernhousewife allows PHP Local File Inclusion.This issue affects Modern Housewife: from n/a through <= 1.0.12.
CVE-2025-68869 2 Lazycoders, Wordpress 2 Lazytasks, Wordpress 2026-01-28 9.8 Critical
Incorrect Privilege Assignment vulnerability in LazyCoders LLC LazyTasks lazytasks-project-task-management allows Privilege Escalation.This issue affects LazyTasks: from n/a through <= 1.4.01.
CVE-2025-68507 2 Icegram, Wordpress 2 Icegram, Wordpress 2026-01-28 6.5 Medium
Missing Authorization vulnerability in Icegram Icegram icegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram: from n/a through <= 3.1.35.
CVE-2025-68073 2 Ninjateam, Wordpress 2 Gpdr Ccpa Compliance Support, Wordpress 2026-01-28 6.5 Medium
Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.4.
CVE-2025-68072 2 Merv Barrett, Wordpress 2 Easy Property Listings, Wordpress 2026-01-28 6.5 Medium
Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.17.