Search

Expected end of text, found 'ır' (at char 36), (line:1, col:37)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (370156 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-15647 2 Berocket, Wordpress 2 Brands For Woocommerce, Wordpress 2026-07-23 4.4 Medium
The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the payload is stored in term meta rather than post content, the WordPress unfiltered_html capability exception does not apply, meaning Shop Manager-level users — who normally lack unfiltered_html — can fully exploit this vulnerability.
CVE-2026-15448 2 Tickera, Wordpress 2 Tickera – Sell Tickets & Manage Events, Wordpress 2026-07-23 6.5 Medium
The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versions up to, and including, 3.6.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with staff-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVE-2026-60205 1 Oracle 1 Weblogic Server 2026-07-23 9.8 Critical
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-27372 2026-07-23 6.5 Medium
Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions.
CVE-2026-27418 2 Epsiloncool, Wordpress 2 Wp Fast Total Search, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.
CVE-2026-57374 2026-07-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions.
CVE-2026-57696 2 Videowhisper, Wordpress 2 Picture Gallery, Wordpress 2026-07-23 7.1 High
Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions.
CVE-2026-57717 2026-07-23 6.5 Medium
Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.
CVE-2026-57808 2 Saad Iqbal, Wordpress 2 Wp Easypay, Wordpress 2026-07-23 6.5 Medium
Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.
CVE-2026-57716 2 Videowhisper, Wordpress 2 Broadcast Live Video, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.
CVE-2026-65474 2 Wordpress, Wpmanageninja 2 Wordpress, Ninja Tables 2026-07-23 5.3 Medium
Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.
CVE-2026-64802 1 Jetbrains 1 Goland 2026-07-23 7.8 High
In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration
CVE-2026-64806 1 Jetbrains 1 Webstorm 2026-07-23 8.4 High
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter
CVE-2026-64807 1 Jetbrains 1 Webstorm 2026-07-23 7.8 High
In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration
CVE-2026-64815 1 Jetbrains 1 Intellij Idea 2026-07-23 8.1 High
In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files
CVE-2026-65908 1 Jetbrains 1 Pycharm 2026-07-23 8.6 High
In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open
CVE-2026-59522 2 Wedevs, Wordpress 2 Wp Erp, Wordpress 2026-07-23 6.5 Medium
Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.
CVE-2026-61949 2 Bookly, Wordpress 2 Bookly, Wordpress 2026-07-23 9.3 Critical
Unauthenticated SQL Injection in Bookly <= 27.7 versions.
CVE-2026-61981 2026-07-23 5.4 Medium
Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.
CVE-2026-65454 2026-07-23 8.5 High
Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions.