Export limit exceeded: 404917 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (103357 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-39778 2 Themeansar, Wordpress-extensions 2 Ansar Import – One Click Starter Sites – For Elementor & Themes, Ansar Import – One Click Starter Sites – For Elementor & Themes 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor &amp; Themes <= 2.1.2 versions.
CVE-2026-39780 2 Wordpress-extensions, Youzify 2 Youzify, Youzify 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.
CVE-2026-39781 2 Dan Rossiter, Wordpress-extensions 2 Document Gallery, Document Gallery 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Document Gallery <= 5.1.1 versions.
CVE-2026-39784 2 Nicdark, Wordpress-extensions 2 Hotel Booking, Hotel Booking 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.
CVE-2026-39792 2 Mitchell Bennis, Wordpress-extensions 2 Simple File List, Simple File List 2026-10-06 8.6 High
Unauthenticated Arbitrary File Deletion in Simple File List <= 6.3.11 versions.
CVE-2026-39793 2 Nicu Micle, Wordpress-extensions 2 Simple Jwt Login, Simple Jwt Login 2026-10-06 8.8 High
Subscriber Broken Authentication in Simple JWT Login 4.0.0 versions.
CVE-2026-39794 2 Wclovers, Wordpress-extensions 2 Woocommerce Multivendor Marketplace, Woocommerce Multivendor Marketplace Rest Api 2026-10-06 7.5 High
Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.
CVE-2026-39796 2 Flipper Code, Wordpress-extensions 2 Advanced Posts Listing – Show Post List Easily, Advanced Posts Listing–show Post List Easily 2026-10-06 7.5 High
Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.
CVE-2026-40806 2 Plugin-devs, Wordpress-extensions 2 Blog, Posts And Category Filter For Elementor, Blog Posts And Category Filter For Elementor 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.
CVE-2026-40807 2 Aman, Wordpress-extensions 2 Cf7 Views – Complete Entry Management For Contact Form 7, Cf7 Views 2026-10-06 7.1 High
Unauthenticated Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.6 versions.
CVE-2026-41559 2 Pluginjoy, Wordpress-extensions 2 Safesnap – Verified Wordpress Backup & Restore, Safesnap 2026-10-06 7.5 High
Unauthenticated Sensitive Data Exposure in SafeSnap – Verified WordPress Backup &amp; Restore <= 2.1.2 versions.
CVE-2026-41560 2 Wordpress-extensions, Wxdlabs 2 Wxd Backup Lite, Wxd Backup Lite 2026-10-06 7.5 High
Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.
CVE-2026-41561 2 Adrian Lin, Wordpress-extensions 2 Museder Restoreone, Museder Restoreone 2026-10-06 7.5 High
Unauthenticated Sensitive Data Exposure in Museder RestoreOne <= 2.7.276 versions.
CVE-2026-41562 2 Norvisgabriel, Wordpress-extensions 2 Norvis Backup, Norvis Backup 2026-10-06 7.5 High
Unauthenticated Sensitive Data Exposure in Norvis Backup <= 1.1.0 versions.
CVE-2026-42413 2 Daftplug, Wordpress-extensions 2 Snapshotify, Snapshotify 2026-10-06 7.5 High
Unauthenticated Sensitive Data Exposure in Snapshotify &#8211; All-in-One Backup &amp; Restore &amp; Migrate <= 1.3.2 versions.
CVE-2026-98356 1 Linux 1 Linux Kernel 2026-10-06 7.0 High
In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup bnxt_re_init_dcb_wq() ignores a failed allocation. The async DCB handler later calls queue_work() on the NULL pointer.
CVE-2014-125130 2 Damjan, Wordpress-extensions 2 Codeart Google Mp3 Audio Player, Codeart Google Mp3 Audio Player 2026-10-06 7.5 High
CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of direct_download.php. Attackers can request paths ../../wp-config.php without authentication to download configuration files containing database credentials and secret keys, leading to full site compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
CVE-2026-105220 1 Klembot 1 Twinejs 2026-10-06 7.8 High
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file, executing code as the user.
CVE-2026-105221 1 Defunkt 1 Gist 2026-10-06 7.4 High
The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists.
CVE-2026-105222 2 Alexpechkarev, Bestwebsoft 2 Google-maps, Google Maps 2026-10-06 7.4 High
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests, steal the API key from the query string, and tamper with responses.