Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8187 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-55142 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2025-09-24 8.8 High
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
CVE-2025-8712 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2025-09-24 5.4 Medium
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure restricted settings.
CVE-2025-55141 1 Ivanti 5 Connect Secure, Neurons For Secure Access, Policy Secure and 2 more 2025-09-24 8.8 High
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
CVE-2025-43806 1 Liferay 2 Dxp, Portal 2025-09-24 N/A
Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GA through update 92 does not properly check permission with import and export tasks, which allows remote authenticated users to access the exported data via the REST APIs.
CVE-2025-57961 2 Codexpert, Wordpress 2 Codesigner, Wordpress 2025-09-24 4.3 Medium
Missing Authorization vulnerability in Codexpert, Inc CoDesigner allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CoDesigner: from n/a through 4.25.2.
CVE-2025-43788 1 Liferay 2 Dxp, Portal 2025-09-24 N/A
The organization selector in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q1.1 through 2024.Q1.12 and 7.4 update 81 through update 85 does not check user permission, which allows remote authenticated users to obtain a list of all organizations.
CVE-2025-57958 1 Wordpress 1 Wordpress 2025-09-24 5.3 Medium
Missing Authorization vulnerability in WPXPO WowAddons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WowAddons: from n/a through 1.0.17.
CVE-2025-57957 1 Wordpress 1 Wordpress 2025-09-24 5.3 Medium
Missing Authorization vulnerability in wpcraft WooMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WooMS: from n/a through 9.12.
CVE-2025-57955 2 Plugin-devs, Wordpress 2 Post Carousel Slider For Elementor, Wordpress 2025-09-24 6.5 Medium
Missing Authorization vulnerability in Plugin Devs Post Carousel Slider for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post Carousel Slider for Elementor: from n/a through 1.7.0.
CVE-2025-57944 2 Skimlinks, Wordpress 2 Affiliate Marketing Tool, Wordpress 2025-09-24 5.3 Medium
Missing Authorization vulnerability in Skimlinks Skimlinks Affiliate Marketing Tool allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Skimlinks Affiliate Marketing Tool: from n/a through 1.3.
CVE-2025-8285 1 Mattermost 2 Confluence, Mattermost 2025-09-24 4 Medium
Mattermost Confluence Plugin version <1.5.0 fails to check the access of the user to the channel which allows attackers to create channel subscription without proper access to the channel via API call to the create channel subscription endpoint.
CVE-2025-57917 3 Printcart, Woocommerce, Wordpress 3 Web To Print Product Designer, Woocommerce, Wordpress 2025-09-23 4.3 Medium
Missing Authorization vulnerability in printcart Printcart Web to Print Product Designer for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Printcart Web to Print Product Designer for WooCommerce: from n/a through 2.4.3.
CVE-2025-57605 1 Aikaan 1 Iot Platform 2025-09-23 8.8 High
Lack of server-side authorisation on department admin assignment APIs in AiKaan IoT Platform allows authenticated users to elevate their privileges by assigning themselves as admins of other departments. This results in unauthorized privilege escalation across the department
CVE-2025-55077 3 Microsoft, Tyler Technologies, Tylertech 3 Windows, Erp Pro 9 Saas, Erp Pro 9 2025-09-23 7.4 High
Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environment with the privileges of the authenticated user. Tyler Technologies deployed hardened remote Windows environment settings to all ERP Pro 9 SaaS customer environments as of 2025-08-01.
CVE-2025-58016 1 Wordpress 1 Wordpress 2025-09-23 4.3 Medium
Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CF7 Submissions: from n/a through 0.26.
CVE-2025-57997 1 Wordpress 1 Wordpress 2025-09-23 4.3 Medium
Missing Authorization vulnerability in Trustpilot Trustpilot Reviews allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Trustpilot Reviews: from n/a through 2.5.925.
CVE-2025-57995 2 Detheme, Wordpress 2 Dethemekit For Elementor, Wordpress 2025-09-23 4.3 Medium
Missing Authorization vulnerability in Detheme DethemeKit For Elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects DethemeKit For Elementor: from n/a through 2.1.10.
CVE-2025-57991 2 Clariti, Wordpress 2 Clariti, Wordpress 2025-09-23 5.4 Medium
Missing Authorization vulnerability in Clariti Clariti allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Clariti: from n/a through 1.2.1.
CVE-2025-57990 2 Solwininfotech, Wordpress 2 Blog Designer, Wordpress 2025-09-23 5.4 Medium
Missing Authorization vulnerability in solwininfotech Blog Designer allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Blog Designer: from n/a through 3.1.8.
CVE-2025-57936 2 Meitar, Wordpress 2 Subresource Integrity Manager, Wordpress 2025-09-23 4.3 Medium
Missing Authorization vulnerability in Meitar Subresource Integrity (SRI) Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Subresource Integrity (SRI) Manager: from n/a through 0.4.0.