Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (12900 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-59522 2 Wedevs, Wordpress 2 Wp Erp, Wordpress 2026-07-23 6.5 Medium
Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.
CVE-2026-65489 2 Lastudio, Wordpress 2 La-studio Element Kit For Elementor, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
CVE-2026-65495 2 Dokan Multivendor Plugin, Wordpress 2 Dokan Pro, Wordpress 2026-07-23 7.5 High
Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.
CVE-2026-65529 2 Iqonicdesign, Wordpress 2 Graphina, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions.
CVE-2026-65531 2 Themeum, Wordpress 2 Qubely, Wordpress 2026-07-23 4.8 Medium
Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.
CVE-2026-59547 2 Easy Payment, Wordpress 2 Payment Gateway For Paypal On Woo Commerce, Wordpress 2026-07-23 7.5 High
Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.
CVE-2026-65484 2 Analogwp, Wordpress 2 Style Kits, Wordpress 2026-07-23 6.3 Medium
Contributor Broken Access Control in Style Kits <= 2.6.5 versions.
CVE-2026-57830 1 Ollyo 1 Helix Ultimate 2026-07-23 9.1 Critical
Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion.
CVE-2026-25424 2 Mediavine, Wordpress 2 Mediavine Control Panel, Wordpress 2026-07-23 4.3 Medium
Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.
CVE-2026-65487 2 Themegoods, Wordpress 2 Photography, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.
CVE-2026-65453 2 Motovnet, Wordpress 2 Ebook Store, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
CVE-2026-27355 2 Metaphorcreations, Wordpress 2 Ditty, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.
CVE-2026-65530 2 Templatespare, Wordpress 2 Templatespare, Wordpress 2026-07-23 4.3 Medium
Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.
CVE-2026-65007 1 Getgrav 1 Grav 2026-07-23 9.6 Critical
The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover.
CVE-2026-65476 2 Uxper, Wordpress 2 Civi, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.
CVE-2026-43947 1 Frangoteam 1 Fuxa 2026-07-23 N/A
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue.
CVE-2026-57703 2 Sunshinephotocart, Wordpress 2 Sunshine Photo Cart, Wordpress 2026-07-23 6.3 Medium
Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.
CVE-2026-25466 2 Wordpress, Wpgmaps 2 Wordpress, Wp Go Maps 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.
CVE-2026-65895 1 Getgrav 1 Grav 2026-07-23 8.5 High
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled.
CVE-2026-13060 1 Mongodb 2 Mongodb, Mongodb Server 2026-07-23 6.5 Medium
An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to an inconsistency in how the $graphLookup aggregation stage is evaluated during authorization and during execution. Affected scenarios involve collections referenced within existing view pipeline definitions.