Search

Expected end of text, found '–' (at char 58), (line:1, col:59)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (360230 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-48836 2 Mantrabrain, Wordpress 2 Easy Invoice, Wordpress 2026-06-23 10 Critical
Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.
CVE-2026-48868 2 Mra13 / Team Tips And Tricks Hq, Wordpress 2 Simple Shopping Cart, Wordpress 2026-06-23 7.5 High
Unauthenticated Insecure Direct Object References (IDOR) in Simple Shopping Cart <= 5.2.9 versions.
CVE-2026-48871 2 Takashi Kitajima, Wordpress 2 Mw Wp Form, Wordpress 2026-06-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in MW WP Form <= 5.1.3 versions.
CVE-2026-48876 2 Web Guy, Wordpress 2 Stop Spammers, Wordpress 2026-06-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions.
CVE-2026-48886 2 Ahmad, Wordpress 2 Js Help Desk, Wordpress 2026-06-23 9.3 Critical
Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.
CVE-2026-48887 2 Ahmad, Wordpress 2 Js Help Desk, Wordpress 2026-06-23 6.5 Medium
Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.
CVE-2026-48889 2 Tms, Wordpress 2 Amelia, Wordpress 2026-06-23 8.8 High
Subscriber Privilege Escalation in Amelia <= 2.3 versions.
CVE-2026-48966 2 Funnelkit, Wordpress 2 Funnel Builder By Funnelkit, Wordpress 2026-06-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.
CVE-2026-49063 2 Webilia Inc., Wordpress 2 Listdom, Wordpress 2026-06-23 7.3 High
Unauthenticated Privilege Escalation in Listdom <= 5.5.0 versions.
CVE-2026-49066 2 Conekta Group, Wordpress 2 Conekta Payment Gateway, Wordpress 2026-06-23 7.5 High
Unauthenticated Sensitive Data Exposure in Conekta Payment Gateway <= 6.0.0 versions.
CVE-2026-49067 2 Wordpress, Yydevelopment 2 Wordpress, Advanced 301 And 302 Redirect 2026-06-23 9.3 Critical
Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions.
CVE-2026-49070 2 Knit Pay, Wordpress 2 Knit Pay, Wordpress 2026-06-23 7.5 High
Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions.
CVE-2026-49082 2 Chatway Live Chat, Wordpress 2 Chatway Live Chat – Ai Chatbot, Customer Support, Faq & Helpdesk Customer Service & Chat Buttons, Wordpress 2026-06-23 7.4 High
Subscriber Sensitive Data Exposure in Chatway Live Chat &#8211; AI Chatbot, Customer Support, FAQ &amp; Helpdesk Customer Service &amp; Chat Buttons <= 1.4.8 versions.
CVE-2026-49780 2 Dokan, Inc., Wordpress 2 Dokan, Wordpress 2026-06-23 8.8 High
Customer Privilege Escalation in Dokan <= 5.0.2 versions.
CVE-2026-52692 2 Wordpress, Wp.insider 2 Wordpress, Affiliates Manager 2026-06-23 7.5 High
Unauthenticated Sensitive Data Exposure in Affiliates Manager <= 2.9.50 versions.
CVE-2026-52694 2 Wordpress, Wp E-signature 2 Wordpress, Signature Add-on For Woocommerce 2026-06-23 7.5 High
Unauthenticated Sensitive Data Exposure in Signature Add-On for WooCommerce <= 2.0 versions.
CVE-2026-52695 2 Al Monsor, Wordpress 2 Abc Crypto Checkout, Wordpress 2026-06-23 7.5 High
Unauthenticated Sensitive Data Exposure in ABC Crypto Checkout <= 1.8.2 versions.
CVE-2026-52700 2 Wcmultishipping – Mondial Relay & Chronopost For Wooommerce, Wordpress 2 Wcmultishipping, Wordpress 2026-06-23 8.5 High
Subscriber SQL Injection in WCMultiShipping <= 3.0.2 versions.
CVE-2026-52702 2 Wordpress, Wp-buy 2 Wordpress, Seo Redirection 2026-06-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.
CVE-2026-48157 1 Slimphp 1 Slim 2026-06-23 6.1 Medium
Slim is a PHP micro framework that enables users to write simple web applications and APIs. In versions 4.4.0 through 4.15, if an application uses HttpException::setTitle() and/or setDescription() to include untrusted/request-derived data in the error title or description (e.g. "No products found matching '{$query}'."), an attacker could inject arbitrary HTML/JavaScript that executes in the victim's browser when they encounter an HTML error page generated by Slim. The vulnerability is present even with displayErrorDetails = false as the unescaped title and description are rendered on this error path. Built-in exceptions (HttpNotFoundException, HttpBadRequestException, etc.) ship plain-text defaults, so a vanilla Slim app with no user code is not exploitable. Only applications that feed untrusted data into setTitle() and/or setDescription() are affected. The issue has been fixed in 4.15.2. If developers are unable to immediately update their applications, they can work around this issue by avoiding passing untrusted/request-derived data into HttpException::setTitle() and setDescription() and using static, plain-text error copy instead. They should also register a custom error renderer (an ErrorRendererInterface implementation, or a subclass of HtmlErrorRenderer that escapes the title and description) for the HTML media type.