Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (381540 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-66640 2 Marcus (aka @msykes), Wordpress 2 Login With Ajax, Wordpress 2026-08-21 6.5 Medium
Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.
CVE-2026-66643 2 Wordpress, Wronganswersonly 2 Wordpress, Wufoo Shortcode 2026-08-21 6.5 Medium
Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.
CVE-2026-66645 2 Wordpress, Wpdeveloper 2 Wordpress, Table Of Contents Block 2026-08-21 6.5 Medium
Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.
CVE-2026-66646 2 Mythemeshop, Wordpress 2 Wp Tab Widget, Wordpress 2026-08-21 6.5 Medium
Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.
CVE-2026-68567 2 Wordpress, Wp Grids 2 Wordpress, Convert Pro 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions.
CVE-2026-73181 2 Themecomplete, Wordpress 2 Extra Product Options & Add-ons For Woocommerce, Wordpress 2026-08-21 7.5 High
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.
CVE-2026-73338 2 Autopay, Wordpress 2 Autopay, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.
CVE-2026-73342 2 Magazine3, Wordpress 2 Wp Multilang, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.
CVE-2026-73359 2 Wordpress, Wp Legal Pages 2 Wordpress, Wp Cookie Notice For Gdpr, Ccpa & Eprivacy Consent 2026-08-21 6.5 Medium
Subscriber Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.3.9 versions.
CVE-2026-73375 2 Supsystic, Wordpress 2 Ultimate Maps By Supsystic, Wordpress 2026-08-21 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2026-73376 2 Supsystic, Wordpress 2 Ultimate Maps By Supsystic, Wordpress 2026-08-21 9.8 Critical
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2026-73377 2 Supsystic, Wordpress 2 Ultimate Maps By Supsystic, Wordpress 2026-08-21 7.5 High
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
CVE-2026-73392 2 Highwarden, Wordpress 2 Super Store Finder, Wordpress 2026-08-21 9.3 Critical
Unauthenticated SQL Injection in Super Store Finder <= 7.8 versions.
CVE-2026-73397 2 Wordpress, Youzify 2 Wordpress, Youzify 2026-08-21 9.8 Critical
Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.
CVE-2026-73399 2 Flutterwave, Wordpress 2 Flutterwave Woocommerce, Wordpress 2026-08-21 6.5 Medium
Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions.
CVE-2026-73994 2 Syed Balkhi, Wordpress 2 Charitable, Wordpress 2026-08-21 7.5 High
Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.
CVE-2026-73997 2 Nexcess, Wordpress 2 Starter Templates By Kadence Wp, Wordpress 2026-08-21 7.5 High
Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.
CVE-2026-74015 2 Merkulove, Wordpress 2 Readabler, Wordpress 2026-08-21 9.3 Critical
Unauthenticated SQL Injection in Readabler < 2.0.18 versions.
CVE-2026-61407 1 Dell 1 Watchdog Timer Driver 2026-08-21 8.8 High
Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation.
CVE-2026-59949 1 Yawkat 1 Lz4-java 2026-08-21 6.5 Medium
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance().hash32().hash(), XXHashFactory.nativeInstance().hash64().hash(), XXHashFactory.nativeInstance().newStreamingHash32().update(), and XXHashFactory.nativeInstance().newStreamingHash64().update(), allowing null arrays or oversized ranges to reach native code, read outside the Java array, and fatally terminate the JVM. This issue is fixed in version 1.11.1.