Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8857 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-65484 2 Analogwp, Wordpress 2 Style Kits, Wordpress 2026-07-23 6.3 Medium
Contributor Broken Access Control in Style Kits <= 2.6.5 versions.
CVE-2026-57830 2026-07-23 N/A
Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion.
CVE-2026-25424 2 Mediavine, Wordpress 2 Mediavine Control Panel, Wordpress 2026-07-23 4.3 Medium
Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.
CVE-2026-61943 2026-07-23 7.5 High
Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.
CVE-2026-65468 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.
CVE-2026-65487 2 Themegoods, Wordpress 2 Photography, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.
CVE-2026-65499 2026-07-23 6.5 Medium
Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.
CVE-2026-65453 2 Motovnet, Wordpress 2 Ebook Store, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
CVE-2026-65478 2026-07-23 5.4 Medium
Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.
CVE-2026-27355 2 Metaphorcreations, Wordpress 2 Ditty, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.
CVE-2026-65530 2 Templatespare, Wordpress 2 Templatespare, Wordpress 2026-07-23 4.3 Medium
Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.
CVE-2026-65007 1 Getgrav 1 Grav 2026-07-23 9.6 Critical
The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover.
CVE-2026-12082 2026-07-23 7.5 High
The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data.
CVE-2026-59677 1 Selinux Project 1 Selinux 2026-07-23 N/A
A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in unconfined context This issue affects policycoreutils through 3.10.
CVE-2026-65476 2 Uxper, Wordpress 2 Civi, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.
CVE-2026-57367 2026-07-23 7.1 High
Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.
CVE-2026-57703 2 Sunshinephotocart, Wordpress 2 Sunshine Photo Cart, Wordpress 2026-07-23 6.3 Medium
Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.
CVE-2025-24259 1 Apple 1 Macos 2026-07-23 9.8 Critical
This issue was addressed with additional entitlement checks. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to retrieve Safari bookmarks without an entitlement check.
CVE-2026-27392 2026-07-23 4.3 Medium
Contributor Broken Access Control in uListing <= 2.2.0 versions.
CVE-2026-25466 2 Wordpress, Wpgmaps 2 Wordpress, Wp Go Maps 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.