Search

Expected end of text, found ':' (at char 26), (line:1, col:27)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (377388 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-66454 2 Maruti Mohanty, Wordpress 2 Wp Social Avatar, Wordpress 2026-08-14 6.5 Medium
Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.
CVE-2026-66455 2 Rockiger, Wordpress 2 Reactpress, Wordpress 2026-08-14 6 Medium
Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.
CVE-2026-66459 2 Space Codes, Wordpress 2 Ai For Seo, Wordpress 2026-08-14 6.5 Medium
Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.
CVE-2026-66462 2 Bookingwp, Wordpress 2 Woocommerce Appointments, Wordpress 2026-08-14 7.5 High
Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.
CVE-2026-66463 2 Hassan Fakih, Wordpress 2 Icarry, Wordpress 2026-08-14 7.5 High
Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.
CVE-2026-66464 2 Toast Plugins, Wordpress 2 Internal Link Optimiser, Wordpress 2026-08-14 6.5 Medium
Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.
CVE-2026-66465 2 Agnihd, Wordpress 2 Cartify, Wordpress 2026-08-14 9.8 Critical
Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions.
CVE-2026-66466 2 Wedevs, Wordpress 2 Storegrowth: Smart Sales Booster For Woocommerce | Bogo, Upsells, Direct Checkout, Quick View, Side Cart, Wordpress 2026-08-14 7.5 High
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.
CVE-2026-66468 2 Powerfulwp, Wordpress 2 Local Delivery Drivers For Woocommerce, Wordpress 2026-08-14 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions.
CVE-2026-66469 2 Afonso Matos, Wordpress 2 Arvow Ai Seo Writer, Wordpress 2026-08-14 7.5 High
Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.
CVE-2026-66654 2 Tangiblewp, Wordpress 2 Vehica Core, Wordpress 2026-08-14 6 Medium
Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.
CVE-2026-66661 2 Onokazu, Wordpress 2 Directories Pro, Wordpress 2026-08-14 7.7 High
Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.
CVE-2026-66691 2 Scriptsbundle, Wordpress 2 Nokri, Wordpress 2026-08-14 9.8 Critical
Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
CVE-2026-16101 1 Silabs.com 1 Wiseconnect 2026-08-14 8.8 High
Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below
CVE-2026-19291 1 Silabs.com 1 Wiseconnect 2026-08-14 8.8 High
Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.
CVE-2026-19292 1 Silabs.com 1 Wiseconnect 2026-08-14 8.8 High
Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.
CVE-2026-19293 1 Silabs.com 1 Wiseconnect 2026-08-14 8.8 High
SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below.
CVE-2026-65932 1 Silabs.com 1 Bt122 2026-08-14 N/A
The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting in a denial of service. See vulnerability B-E2 in the related paper below.
CVE-2026-73505 1 Jandedobbeleer 1 Oh-my-posh 2026-08-14 7.8 High
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1.
CVE-2026-65933 1 Silabs.com 1 Bt122 2026-08-14 N/A
A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below.