Export limit exceeded: 424637 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 10773 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10773 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-119168 1 Hashicorp 2 Nomad, Nomad Enterprise 2026-10-30 8.8 High
HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files, potentially leading to privilege escalation. This vulnerability (CVE-2026-119168) is fixed in Nomad 2.1.1 and Nomad Enterprise 2.1.0, 1.11.12, and 1.10.18.
CVE-2026-119526 2026-10-30 9.8 Critical
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.
CVE-2026-118089 2026-10-30 7.2 High
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
CVE-2026-118090 2026-10-30 8.8 High
Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.
CVE-2026-62131 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.
CVE-2026-62016 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.
CVE-2026-62015 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.
CVE-2026-62014 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.
CVE-2026-62011 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.
CVE-2026-62010 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.
CVE-2026-62009 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.
CVE-2026-62005 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.
CVE-2026-62004 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.
CVE-2026-62003 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Mission <= 1.22 versions.
CVE-2026-61998 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
CVE-2026-61997 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
CVE-2026-61992 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
CVE-2026-54860 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
CVE-2026-54857 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
CVE-2026-54856 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.