Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (11934 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-62035 2026-10-11 6.3 Medium
Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.
CVE-2026-62033 2026-10-11 7.6 High
Subscriber Settings Change in uListing <= 2.2.0 versions.
CVE-2026-62028 2026-10-11 5.4 Medium
Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Before After Image Comparison – Image comparison for WP: from n/a through 1.1.21.
CVE-2026-42706 2026-10-11 7.5 High
Unauthenticated Broken Access Control in DK <= 3.2.1 versions.
CVE-2026-42705 2026-10-11 7.5 High
Unauthenticated Broken Access Control in Grand News <= 3.4 versions.
CVE-2026-40808 2026-10-11 6.5 Medium
Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.
CVE-2026-40801 2026-10-11 8.1 High
Subscriber Broken Access Control in Wordable <= 8.2.10 versions.
CVE-2026-40777 2026-10-11 8.1 High
Subscriber Broken Access Control in WPSection <= 1.5.1 versions.
CVE-2026-107419 2026-10-11 5.4 Medium
Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translations-for-polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Translation for Polylang: from n/a through 1.6.2.
CVE-2026-106609 2026-10-11 7.5 High
Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.
CVE-2026-103685 2026-10-11 4.3 Medium
Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4.
CVE-2026-103357 2026-10-11 N/A
Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3.
CVE-2026-105989 2026-10-10 5.3 Medium
The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation checks on one of its AJAX actions, allowing unauthenticated attackers to forge the stored transaction status of records and to write the Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7's status metadata onto arbitrary posts.
CVE-2026-62128 2 Creator Lms, Wordpress-extensions 2 Creator Lms, Creator Lms 2026-10-10 5.3 Medium
Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through 1.2.21.
CVE-2026-96461 2026-10-09 7.5 High
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.
CVE-2026-95589 2026-10-09 6.5 Medium
Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Deposits and Partial Payments for WooCommerce: from n/a through 4.0.1.
CVE-2026-62042 2026-10-09 5.3 Medium
Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scripts n Styles: from n/a through 3.5.8.
CVE-2026-105883 2026-10-09 7.1 High
Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Th Shop Mania: from n/a through 1.9.1.
CVE-2026-73665 2 Freepbx, Sangoma 2 Ucp, Freepbx 2026-10-09 9.8 Critical
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.
CVE-2026-79842 1 Hewlett Packard Enterprise(hpe) 1 Intelligent Management Center 2026-10-09 9.1 Critical
An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713