Search

Expected end of text, found '\' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (389576 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-84753 2 Getwpfunnels, Wordpress 2 Mail Mint, Wordpress 2026-09-07 9.8 Critical
Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.
CVE-2026-84754 2 Getwpfunnels, Wordpress 2 Wpfunnels, Wordpress 2026-09-07 6.5 Medium
Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.
CVE-2026-84755 2 Getwpfunnels, Wordpress 2 Mail Mint, Wordpress 2026-09-07 6.5 Medium
Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.
CVE-2026-84758 2 Strategy11team, Wordpress 2 Business Directory Plugin, Wordpress 2026-09-07 6.5 Medium
Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.
CVE-2026-84766 2 Wordpress, Wpmanageninja 2 Wordpress, Fluent Booking 2026-09-07 5.9 Medium
Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.
CVE-2026-84812 2 Wordplus, Wordpress 2 Better Messages, Wordpress 2026-09-07 7.1 High
Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.
CVE-2026-85303 2 Magepeople, Wordpress 2 Booking & Rental Manager, Wordpress 2026-09-07 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7.
CVE-2026-75160 1 Mbs-solutions 1 X-serie Gateway 2026-09-07 9.1 Critical
An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi.
CVE-2026-31020 1 Arc53 1 Docsgpt 2026-09-07 9.8 Critical
In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attacker can inject malicious template expressions, leading to a server-side template injection (SSTI) vulnerability that can be exploited to achieve full remote code execution (RCE).
CVE-2026-75430 1 Powerjob 1 Powerjob 2026-09-07 9.8 Critical
PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code.
CVE-2021-44320 1 Parrot 1 Ar.drone 2026-09-07 7.5 High
Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm the device availability (i.e., video streaming and control) by using tool to perform an IPv4 flood attack. Verified attacks includes SYN flooding and UDP flooding.
CVE-2026-75431 1 Powerjob 1 Powerjob 2026-09-07 9.1 Critical
PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code.
CVE-2026-75163 1 Mbs-solutions 1 X-serie Gateway 2026-09-07 6.5 Medium
An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 returns detailed system version fields (operatingsystem, gatewayversion) to any authenticated user, including users with the low-privileged Standard role.
CVE-2026-75168 1 Mbs-solutions 1 X-serie Gateway 2026-09-07 6.3 Medium
An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/.
CVE-2026-75164 1 Mbs-solutions 1 X-serie Gateway 2026-09-07 6.5 Medium
An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter.
CVE-2026-75167 1 Mbs-solutions 1 X-serie Gateway 2026-09-07 N/A
A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts.
CVE-2026-75171 1 Hubcore 1 Hubcore 2026-09-07 N/A
An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component.
CVE-2026-19057 1 Gastromenum 1 Gastromenum Ticket And Qr Menu System 2026-09-07 5.4 Medium
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31.
CVE-2026-19081 1 Gastromenum 1 Gastromenum Ticket And Qr Menu System 2026-09-07 4.3 Medium
Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31.
CVE-2026-19727 1 Yordam Information Technology Consulting, Training And Electronic Systems Industry And Trade Inc. 1 Library Information And Document Automation Program 2026-09-07 6.1 Medium
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issue affects Library Information and Document Automation Program: before v22.2.