Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (11496 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-63078 2026-06-26 4.3 Medium
Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.
CVE-2026-54832 2026-06-26 7.5 High
Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.
CVE-2026-54840 2026-06-26 7.3 High
Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.
CVE-2026-56025 2026-06-26 7.5 High
Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.
CVE-2026-56038 2026-06-26 8.8 High
Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.
CVE-2026-56063 2026-06-26 8.3 High
Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.
CVE-2026-57923 1 Jetbrains 1 Youtrack 2026-06-26 5.3 Medium
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings
CVE-2025-63041 2026-06-26 5.4 Medium
Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.
CVE-2026-57925 1 Jetbrains 1 Youtrack 2026-06-26 4.3 Medium
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
CVE-2026-57323 2026-06-26 5.8 Medium
Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.
CVE-2026-57921 1 Jetbrains 1 Youtrack 2026-06-26 4.3 Medium
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint
CVE-2026-57922 1 Jetbrains 1 Youtrack 2026-06-26 3.1 Low
In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible
CVE-2025-64636 2026-06-26 5.3 Medium
Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.
CVE-2026-57430 2026-06-26 4.3 Medium
Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.
CVE-2025-63079 2026-06-26 4.3 Medium
Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.
CVE-2026-54846 2026-06-26 7.5 High
Unauthenticated Broken Access Control in Syncee Premium Dropshipping &amp; Wholesale <= 1.0.27 versions.
CVE-2026-57640 2026-06-26 4.3 Medium
Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.
CVE-2026-54027 1 Danny-avila 1 Libre Chat 2026-06-26 6.5 Medium
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated user to upload files into any agent's tool_resources (e.g., context, execute_code) without verifying ownership or EDIT permission on the target agent. A permission check was added to the POST /api/files route in a previous patch, but the image upload route was never updated with the same check. An attacker can simply use the image endpoint instead of the file endpoint to bypass the authorization entirely. This vulnerability is fixed in 0.8.4-rc1.
CVE-2026-23513 1 Fossbilling 1 Fossbilling 2026-06-26 N/A
FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, a query-construction flaw in client list endpoints allowed authenticated clients to bypass tenant scoping and retrieve other clients’ data. Details In ServiceTransaction::getSearchQuery() and Order\Service::getSearchQuery(), OR-based search/action filters were appended without grouping, allowing SQL operator precedence to evaluate OR clauses independently of the enforced client_id constraint. Crafted requests could therefore return records and metadata belonging to other clients, including identifiers, amounts, status, timestamps, and related fields. This issue was fixed in version 0.8.0.
CVE-2026-57660 2026-06-26 5.3 Medium
Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.