Search

Expected end of text, found ':' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (342367 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-2924 2026-04-04 6.4 Medium
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageLoad' parameter in versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-22815 1 Aio-libs 1 Aiohttp 2026-04-04 7.5 High
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.
CVE-2026-32186 1 Microsoft 1 Bing 2026-04-04 6.5 Medium
Microsoft Bing Elevation of Privilege Vulnerability
CVE-2026-26135 1 Microsoft 1 Azure Custom Locations Resource Provider 2026-04-04 9.6 Critical
Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network.
CVE-2026-33107 1 Microsoft 1 Azure Databricks 2026-04-04 10 Critical
Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-32213 1 Microsoft 1 Azure Ai Foundry 2026-04-04 10 Critical
Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-34931 1 Hoppscotch 1 Hoppscotch 2026-04-04 N/A
hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account. This issue has been patched in version 2026.3.0.
CVE-2026-34932 1 Hoppscotch 1 Hoppscotch 2026-04-04 N/A
hoppscotch is an open source API development ecosystem. Prior to version 2026.3.0, there is a stored XSS vulnerability that can lead to CSRF. This issue has been patched in version 2026.3.0.
CVE-2026-28703 1 Zohocorp 1 Manageengine Exchange Reporter Plus 2026-04-04 7.3 High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Mails Exchanged Between Users report.
CVE-2026-3880 1 Zohocorp 1 Manageengine Exchange Reporter Plus 2026-04-04 7.3 High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Public Folder Client Permissions report.
CVE-2026-4108 1 Zohocorp 1 Manageengine Exchange Reporter Plus 2026-04-04 7.3 High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Non-Owner Mailbox Permission report.
CVE-2026-4107 1 Zohocorp 1 Manageengine Exchange Reporter Plus 2026-04-04 7.3 High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Folder Message Count and Size report.
CVE-2026-3879 1 Zohocorp 1 Manageengine Exchange Reporter Plus 2026-04-04 7.3 High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Equipment Mailbox Details report.
CVE-2026-28756 1 Zohocorp 1 Manageengine Exchange Reporter Plus 2026-04-04 7.3 High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions based on Distribution Groups report.
CVE-2026-33105 1 Microsoft 1 Azure Kubernetes Service 2026-04-04 10 Critical
Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-28754 1 Zohocorp 1 Manageengine Exchange Reporter Plus 2026-04-04 7.3 High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Distribution Lists report.
CVE-2026-32211 1 Microsoft 1 Azure Web Apps 2026-04-04 9.1 Critical
Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network.
CVE-2026-35535 1 Sudo Project 1 Sudo 2026-04-04 7.4 High
In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer, is not a fatal error and can lead to privilege escalation.
CVE-2026-27655 1 Zohocorp 1 Manageengine Exchange Reporter Plus 2026-04-04 7.3 High
Zohocorp ManageEngine Exchange Reporter Plus versions before 5802 are vulnerable to Stored XSS in Permissions Based on Mailboxes report.
CVE-2020-37216 2026-04-04 7.5 High
Hirschmann HiOS devices versions prior to 08.1.00 and 07.1.01 contain a denial of service vulnerability in the EtherNet/IP stack where improper handling of packet length fields allows remote attackers to crash or hang the device. Attackers can send specially crafted UDP EtherNet/IP packets with a length value larger than the actual packet size to render the device inoperable.