Export limit exceeded: 10778 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10778 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-65578 2026-10-24 9.8 Critical
Unauthenticated PHP Object Injection in Agora <= 1.9 versions.
CVE-2026-65552 2 Qlstudio, Wordpress 2 Export User Data, Wordpress 2026-10-24 9.8 Critical
Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions.
CVE-2026-65573 2 Themerex, Wordpress 2 Abelle, Wordpress 2026-10-24 9.8 Critical
Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.
CVE-2026-63426 1 Lenovo 1 Dock Manager 2026-10-24 7.1 High
During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges.
CVE-2026-114704 2026-10-24 7.2 High
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
CVE-2026-114196 2026-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue affects Paytium: from n/a through 5.0.5.
CVE-2026-112859 2026-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16.
CVE-2026-112858 2026-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3.
CVE-2026-112856 2026-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10.
CVE-2026-112855 2026-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5.
CVE-2026-112854 2026-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6.
CVE-2026-112852 2026-10-24 8.1 High
Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12.
CVE-2026-112851 2026-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9.
CVE-2026-112848 2026-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0.
CVE-2026-112847 2026-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13.
CVE-2026-112846 2026-10-24 9.8 Critical
Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14.
CVE-2026-71559 1 Apache 1 Fory 2026-10-24 7.5 High
Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0.  Users of other language implementations are not affected. Users are recommended to upgrade to version 1.5.0, which fixes the issue.
CVE-2026-65497 2 Complianz, Wordpress 2 Complianz, Wordpress 2026-10-24 7.2 High
Administrator PHP Object Injection in Complianz <= 7.5.0 versions.
CVE-2026-96243 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-10-24 7.8 High
Improper link resolution before file access ('link following') in Windows WalletService allows an authorized attacker to elevate privileges locally.
CVE-2026-96944 1 Microsoft 11 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 8 more 2026-10-24 5.5 Medium
Insertion of sensitive information into externally-accessible file or directory in Windows Storage allows an authorized attacker to disclose information locally.