Search

Expected end of text, found '/' (at char 50), (line:1, col:51)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (402009 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-32581 2026-10-06 7.1 High
Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.
CVE-2026-32580 2026-10-06 7.5 High
Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.
CVE-2026-32579 2026-10-06 10 Critical
Unauthenticated Arbitrary File Upload in Kognetiks Chatbot for WordPress <= 2.4.9 versions.
CVE-2026-32578 2026-10-06 7.1 High
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
CVE-2026-32577 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.
CVE-2026-32575 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.
CVE-2026-32574 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Smart Forms <= 2.6.104 versions.
CVE-2026-32572 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.
CVE-2026-32571 2026-10-06 6.5 Medium
Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.
CVE-2026-32570 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.
CVE-2026-32569 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
CVE-2026-32568 2026-10-06 9.9 Critical
Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions.
CVE-2026-32557 2026-10-06 9.3 Critical
Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions.
CVE-2026-25434 2026-10-06 8.5 High
Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
CVE-2026-25433 2026-10-06 7.1 High
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
CVE-2026-105778 1 Tenda 2 Ac5, Ac5 Firmware 2026-10-06 9.9 Critical
A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-4889 1 Rdl Technologies 1 Eloanapp Platform 2026-10-06 N/A
SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/ajax/users.php?op=verify'. The parameter is vulnerable to boolean-based and time-based SQL injection. Successfully exploiting this vulnerability would allow an attacker to discover the platform's database engine and cause delays in database queries.
CVE-2026-105809 1 Sourcecodester 1 Simple Student Information System 2026-10-06 4.3 Medium
A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVE-2026-105879 2026-10-06 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.
CVE-2026-94271 2026-10-06 N/A
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders marked as paid without any payment being taken.