Search

Expected end of text, found '/' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (421043 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-112345 2 Sciener, Ttlock 2 Ttlock App, Ttlock 2026-10-30 8.1 High
TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction.
CVE-2026-62047 2 Liquid Web / Stellarwp, Wordpress-extensions 2 Event Tickets, Event Tickets 2026-10-30 4.3 Medium
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2.
CVE-2026-114572 1 Drupal 1 Domain Login Restrict 2026-10-30 5.4 Medium
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Domain Login Restrict allows Authentication Bypass. This issue affects Domain Login Restrict versions: from 0.0.0 to 1.5.0.
CVE-2026-114543 1 Drupal 1 Simple User Management 2026-10-30 N/A
Incorrect Authorization vulnerability in Drupal Simple User Management allows Forceful Browsing. This issue affects Simple User Management versions: from 0.0.0 to 1.11.0.
CVE-2026-107311 1 Drupal 1 Permissions By Term 2026-10-30 3.7 Low
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affects Permissions by Term versions: from 0.0.0 to 3.1.41.
CVE-2026-107310 1 Drupal 1 Freelinking 2026-10-30 4.3 Medium
Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking versions: from 0.0.0 to 4.0.3.
CVE-2026-107309 1 Drupal 1 Easy Breadcrumb 2026-10-30 3.7 Low
Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.
CVE-2026-107307 1 Drupal 1 Smartlinker Ai 2026-10-30 4.3 Medium
Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.0.0 to 1.0.3.
CVE-2026-107267 1 Drupal 1 Dkan 2026-10-30 5.3 Medium
Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.
CVE-2026-107268 1 Drupal 1 Two Factor Authentication - Tfa / Passwordless Login 2026-10-30 4.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA / Passwordless Login allows Forceful Browsing. This issue affects Two Factor Authentication - TFA / Passwordless Login versions: from 0.0.0 to 5.4.1, from 5.5.0 to 5.5.2.
CVE-2026-96389 1 Drupal 1 Xray Audit 2026-10-30 6.5 Medium
Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.
CVE-2026-107265 1 Drupal 1 Leaflet 2026-10-30 5.4 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet allows Stored XSS. This issue affects Leaflet versions: from 0.0.0 to 10.4.13.
CVE-2026-107264 1 Drupal 1 Inline Formatter Field 2026-10-30 5.4 Medium
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field allows Code Injection. This issue affects Inline Formatter Field versions: from 0.0.0 to 4.2.0.
CVE-2026-107263 1 Drupal 1 Gutenberg 2026-10-30 5.4 Medium
Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing. This issue affects Gutenberg versions: from 0.0.0 to 2.15.0, from 3.0.0 to 3.0.7.
CVE-2026-107261 1 Drupal 1 Authenticator Login Plus (2fa) 2026-10-30 4.2 Medium
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
CVE-2026-107259 1 Drupal 1 Linked Field 2026-10-30 5.4 Medium
Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code Injection. This issue affects Linked Field versions: from 0.0.0 to 1.8.0.
CVE-2026-107258 1 Drupal 1 Inline Entity Form Dialog 2026-10-30 5.4 Medium
Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing. This issue affects Inline Entity Form Dialog versions: from 0.0.0 to 1.0.6.
CVE-2026-107257 1 Drupal 1 Actstream 2026-10-30 6.5 Medium
Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing. This issue affects Actstream versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1.
CVE-2026-107254 1 Drupal 1 Authenticator Login Plus (2fa) 2026-10-30 4.8 Medium
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows Authentication Bypass. This issue affects Authenticator Login Plus (2FA) versions: from 0.0.0 to 1.0.1.
CVE-2026-107252 1 Drupal 1 Mathjax: Latex For Drupal 2026-10-30 5.4 Medium
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: LaTeX for Drupal allows Cross-Site Scripting (XSS). This issue affects MathJax: LaTeX for Drupal versions: from 0.0.0 to 4.1.2.