Search

Expected end of text, found '.' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (330484 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-22278 1 Dell 1 Powerscale Onefs 2026-01-28 8.1 High
Dell PowerScale OneFS versions prior to 9.13.0.0 contains an improper restriction of excessive authentication attempts vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.
CVE-2026-24530 1 Wordpress 1 Wordpress 2026-01-28 5.3 Medium
Missing Authorization vulnerability in sheepfish WebP Conversion webp-conversion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebP Conversion: from n/a through <= 2.1.
CVE-2025-68047 2 Arraytics, Wordpress 2 Eventin, Wordpress 2026-01-28 8.8 High
Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.1.
CVE-2025-68046 2 Themehunk, Wordpress 2 Contact Form & Lead Form Elementor Builder, Wordpress 2026-01-28 6.5 Medium
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.
CVE-2025-68041 2 Codisto, Wordpress 2 Omnichannel For Woocommerce, Wordpress 2026-01-28 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codisto Omnichannel for WooCommerce codistoconnect allows Stored XSS.This issue affects Omnichannel for WooCommerce: from n/a through <= 1.3.65.
CVE-2025-68035 1 Wordpress 1 Wordpress 2026-01-28 7.5 High
Insertion of Sensitive Information Into Sent Data vulnerability in tabbyai Tabby Checkout tabby-checkout allows Retrieve Embedded Sensitive Data.This issue affects Tabby Checkout: from n/a through <= 5.8.4.
CVE-2025-68034 1 Wordpress 1 Wordpress 2026-01-28 9.3 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL Injection.This issue affects CleverReach® WP: from n/a through <= 1.5.22.
CVE-2025-68030 1 Wordpress 1 Wordpress 2026-01-28 7.2 High
Server-Side Request Forgery (SSRF) vulnerability in WP Messiah Frontis Blocks frontis-blocks allows Server Side Request Forgery.This issue affects Frontis Blocks: from n/a through <= 1.1.5.
CVE-2025-68018 3 Ilmosys, Woocommerce, Wordpress 3 Order Listener For Woocommerce, Woocommerce, Wordpress 2026-01-28 9.4 Critical
Missing Authorization vulnerability in ilmosys Order Listener for WooCommerce woc-order-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Listener for WooCommerce: from n/a through <= 3.6.1.
CVE-2025-68017 2 Antideo, Wordpress 2 Email Validator, Wordpress 2026-01-28 7.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Antideo Antideo Email Validator antideo-email-validator allows Blind SQL Injection.This issue affects Antideo Email Validator: from n/a through <= 1.0.10.
CVE-2025-68016 3 Onepay Sri Lanka, Woocommerce, Wordpress 3 Onepay Payment Gateway For Woocommerce, Woocommerce, Wordpress 2026-01-28 6.5 Medium
Missing Authorization vulnerability in Onepay Sri Lanka onepay Payment Gateway For WooCommerce onepay-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onepay Payment Gateway For WooCommerce: from n/a through <= 1.1.2.
CVE-2025-68015 2 Vollstart, Wordpress 2 Event Tickets With Ticket Scanner, Wordpress 2026-01-28 9 Critical
Improper Control of Generation of Code ('Code Injection') vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Code Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.8.3.
CVE-2026-22279 1 Dell 1 Powerscale Onefs 2026-01-28 4.3 Medium
Dell PowerScale OneFS, versions prior 9.13.0.0, contains an insufficient logging vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information tampering.
CVE-2025-64677 1 Microsoft 2 Office Out-of-box Experience, Office Out Of-box Experience 2026-01-28 8.2 High
Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-64675 1 Microsoft 2 Azure Cosmos Db, Cosmos Db 2026-01-28 8.3 High
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Cosmos DB allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-64676 1 Microsoft 2 Office Purview, Purview 2026-01-28 7.2 High
'.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network.
CVE-2025-65037 1 Microsoft 1 Azure Container Apps 2026-01-28 10 Critical
Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network.
CVE-2025-65041 1 Microsoft 1 Partner Center 2026-01-28 10 Critical
Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
CVE-2025-64663 1 Microsoft 2 Azure Cognitive Service For Language, Azure Language 2026-01-28 9.9 Critical
Custom Question Answering Elevation of Privilege Vulnerability
CVE-2025-64679 1 Microsoft 21 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 18 more 2026-01-28 7.8 High
Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.