Search vulnerabilities

Expected end of text, found '\' (at char 28), (line:1, col:29)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,471

CVE-2026-75626

SpiderFoot Stored Cross-Site Scripting via Correlation Titles

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Smicallef
Products
Spiderfoot
CVE-2026-19447

Stored XSS in Fileorbis Informatics's FileOrbis

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Fileorbis
Products
Fileorbis
CVE-2026-5224

Sensitive Data Exposure in Kriptek Crypto's Cryptosim

Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade Inc. Cryptosim allows Retrieve Embedded Sensitive Data. This issue affects Cryptosim: before 3.1.0.229.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Kriptok Crypto
Products
Cryptosim
CVE-2026-16309

IDOR in Netiket Information Technologies' EdoWEB

Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Netiket Information Technologies
Products
Edoweb
CVE-2026-50575

BetterDesk has a replay behavior vulnerability when devices are deleted

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Unitronix
Products
Betterdesk
CVE-2026-32444

WordPress Cwicly plugin <= 1.4.4 - Remote Code Execution (RCE) vulnerability

Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Cwicly Wordpress
Products
Cwicly Wordpress
CVE-2026-32474

WordPress Templatiq plugin <= 0.2.5 - Arbitrary File Upload vulnerability

Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpwax
Products
Wordpress Templatiq
CVE-2026-66634

WordPress Modal Survey plugin <= 2.0.2.2.3 - Insecure Direct Object References (IDOR) vulnerability

Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pantherius Wordpress
Products
Modal Survey Wordpress