Search vulnerabilities

Expected end of text, found '–' (at char 11), (line:1, col:12)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,948

CVE-2026-11936

Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Security Verify Access Security Verify Access Container Verify Identity Access and 1 more
CVE-2026-108486

WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-108482

WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-108481

WordPress Patreon WordPress plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.10.0.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-108479

WordPress Patreon WordPress plugin <= 1.9.17 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Patreon Patreon WordPress patreon-connect allows Cross Site Request Forgery.This issue affects Patreon WordPress: from n/a through 1.9.17.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-108478

WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-108476

WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.13.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-108475

WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a through 7.3.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-108474

SQL Injection in JetBrains Exposed Prior to 1.5.1

In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Exposed
CVE-2026-107862

WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-105466

IBM® Db2® is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Db2
CVE-2026-104364

IBM® Db2® Denial of Service

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a local attacker to cause a denial of service due to improper input validation.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Db2
CVE-2026-104332

IBM® Db2® Denial of Service

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Db2
CVE-2026-103080

WordPress Salevo plugin <= 1.3.0 - Broken Access Control vulnerability

External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-27902

IBM Db2 Recovery Expert for Linux, Unix and Windows Information Disclosure

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the victims’ web browser

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Db2 Recovery Expert
CVE-2025-27897

IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Db2 Recovery Expert
CVE-2025-27896

IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Db2 Recovery Expert
CVE-2025-27895

DB2 Recovery Expert for Linux, UNIX and Windows Cross-Site Scripting

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Db2 Recovery Expert
CVE-2026-97062

Aureus ERP 1.6.0 Stored XSS via SVG File Upload

Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing authenticated users to upload malicious SVG files containing JavaScript. Attackers can craft SVG files with script elements that execute in the application's origin when the file URL is opened directly, enabling session cookie theft and CSRF token exfiltration.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Webkul
Products
Aureus Erp