Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (11929 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-65551 2 Soflyy, Wordpress 2 Breakdance, Wordpress 2026-10-24 7.5 High
Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.
CVE-2026-66678 2 Justinkruit, Wordpress 2 Advanced Custom Fields:font Awesome Field, Wordpress 2026-10-24 4.3 Medium
Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.
CVE-2026-66470 2 Shabti, Wordpress 2 Frontend Admin By Dynamapps, Wordpress 2026-10-24 7.1 High
Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.
CVE-2026-66379 1 Jfrog 1 Artifactory 2026-10-24 4.3 Medium
An authenticated user may view private Puppet module metadata without repository read access.
CVE-2026-97352 2026-10-24 4.3 Medium
The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.
CVE-2026-114705 2026-10-24 6.5 Medium
Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.
CVE-2026-114192 2026-10-24 6.5 Medium
Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.
CVE-2026-114191 2026-10-24 7.5 High
Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.
CVE-2026-110892 3 Brainstorm Force, Brainstormforce, Wordpress-extensions 3 Suredash, Suredash, Suredash 2026-10-24 6.5 Medium
Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.
CVE-2026-72797 2 B3log, Siyuan 2 Siyuan, Siyuan 2026-10-24 5.8 Medium
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted notebooks and their current unlock status, revealing sensitive notebook names and decryption state in memory.
CVE-2026-73401 2 Instawp, Wordpress 2 Instawp Connect, Wordpress 2026-10-24 5.3 Medium
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
CVE-2026-72805 2 B3log, Siyuan 2 Siyuan, Siyuan 2026-10-24 5.8 Medium
SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block content snippets, reference text, and path metadata for publish-forbidden or password-protected documents by supplying block IDs.
CVE-2026-72798 2 B3log, Siyuan 2 Siyuan, Siyuan 2026-10-24 8.6 High
SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases to retrieve sensitive content, or bypass row filtering entirely when the first column is a non-block type.
CVE-2026-16799 1 Devolutions 1 Powershell Universal 2026-10-24 5 Medium
Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks.
CVE-2026-65479 2 Mvp Themes, Wordpress 2 Reviewer, Wordpress 2026-10-24 5.4 Medium
Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.
CVE-2026-65525 2 Uxper, Wordpress 2 Civi Framework, Wordpress 2026-10-24 5.3 Medium
Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.
CVE-2026-65485 2 Daniel Iser, Wordpress 2 Content Control, Wordpress 2026-10-24 5.3 Medium
Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.
CVE-2026-111092 1 Jetbrains 1 Youtrack 2026-10-24 6.5 Medium
In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands
CVE-2026-91504 2 Oracle, Oracle Corporation 2 Webcenter Content, Oracle Webcenter Content 2026-10-24 7.5 High
Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-107431 2 Crocoblock, Wordpress-extensions 2 Jetformbuilder, Jetformbuilder 2026-10-24 7.5 High
Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.