Search

Expected end of text, found ':' (at char 22), (line:1, col:23)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (374264 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-65523 2 Approveme, Wordpress 2 Formidable Forms Signature Online Contract Automation, Wordpress 2026-08-07 7.5 High
Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions.
CVE-2026-65541 2 Solutioned, Wordpress 2 Staff Training, Wordpress 2026-08-07 7.3 High
Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.
CVE-2026-65542 2 Rajat Varlani, Wordpress 2 Super Socializer, Wordpress 2026-08-07 8.8 High
Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions.
CVE-2026-65543 2 Vimeodev, Wordpress 2 Vimeo, Wordpress 2026-08-07 7.5 High
Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions.
CVE-2026-65544 2 Rajat Varlani, Wordpress 2 Super Socializer, Wordpress 2026-08-07 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.
CVE-2026-65546 2 Qode, Wordpress 2 Qode Tours, Wordpress 2026-08-07 9.3 Critical
Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions.
CVE-2026-65553 2 Wbolt.com, Wordpress 2 Spider Analyser – Wordpress搜索引擎蜘蛛分析插件, Wordpress 2026-08-07 10 Critical
Unauthenticated Remote Code Execution (RCE) in Spider Analyser &#8211; WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions.
CVE-2026-65554 2 Lattepress, Wordpress 2 Anspress – Question And Answer, Wordpress 2026-08-07 7.1 High
Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.
CVE-2026-65556 2 Mihche, Wordpress 2 Wpbruiser {no- Captcha Anti-spam}, Wordpress 2026-08-07 9.8 Critical
Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions.
CVE-2026-65571 2 Axiomthemes, Wordpress 2 69 Clothing, Wordpress 2026-08-07 9.8 Critical
Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions.
CVE-2026-65572 2 Axiomthemes, Wordpress 2 A.williams, Wordpress 2026-08-07 9.8 Critical
Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.
CVE-2026-66452 2 It-recht Kanzlei, Wordpress 2 Legal Text Connector Of The It-recht Kanzlei, Wordpress 2026-08-07 6.5 Medium
Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.
CVE-2026-66665 2 Brandexponents, Wordpress 2 Type Hub, Wordpress 2026-08-07 10 Critical
Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.
CVE-2026-66681 2 Jeff Farthing, Wordpress 2 Theme My Login, Wordpress 2026-08-07 4.3 Medium
Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.
CVE-2026-66683 2 Wordpress, Wp Zone 2 Wordpress, Custom Css And Javascript 2026-08-07 5.3 Medium
Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.
CVE-2026-66685 2 Alex, Wordpress 2 Featured Video Plus, Wordpress 2026-08-07 5.3 Medium
Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.
CVE-2026-66686 2 Vladimir Garagulya, Wordpress 2 Plugins Garbage Collector (database Cleanup), Wordpress 2026-08-07 6.5 Medium
Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.
CVE-2026-66696 2 Nexcess, Wordpress 2 Gutenberg Blocks By Kadence Blocks, Wordpress 2026-08-07 4.3 Medium
Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.
CVE-2026-70646 1 Vovchic17 1 Aiosend 2026-08-07 7.5 High
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Version 3.0.7 fixes the issue. Some workarounds are available. Restrict request body size at the reverse proxy or web framework, rate-limit webhook endpoints, and/or reject oversized requests before JSON parsing.
CVE-2026-53977 1 Bohdan Triapitsyn 1 Openchamber 2026-08-07 7.5 High
OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler chain. Attackers can exploit the route registration order in bootstrap-runtime.js to reach the shutdown handler before auth middleware executes, causing denial of service to all active AI coding sessions and locking out legitimate remote users regardless of whether UI_PASSWORD is configured.