Search

Expected end of text, found '/' (at char 25), (line:1, col:26)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (396944 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-93618 2026-09-23 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. This issue affects JetTricks: from n/a through 2.0.1.
CVE-2026-96656 1 Plex 1 Media Server 2026-09-23 7.2 High
Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
CVE-2026-95593 2026-09-23 7.6 High
Editor SQL Injection in Ultimeter <= 3.0.8 versions.
CVE-2026-94684 2026-09-23 6.5 Medium
Contributor Cross Site Scripting (XSS) in Ocean Extra <= 2.6.1 versions.
CVE-2026-94680 2026-09-23 6.5 Medium
Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions.
CVE-2026-94500 2026-09-23 6.5 Medium
Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.
CVE-2026-94487 2026-09-23 8.1 High
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.
CVE-2026-94461 2026-09-23 6.5 Medium
Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.
CVE-2026-94391 2026-09-23 6.5 Medium
Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.
CVE-2026-94176 2026-09-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.
CVE-2026-94174 2026-09-23 7.6 High
Administrator SQL Injection in Email Log <= 2.63 versions.
CVE-2026-94079 2026-09-23 5.3 Medium
Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.
CVE-2026-93773 2026-09-23 8.5 High
Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.
CVE-2026-93623 2026-09-23 5.3 Medium
Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.
CVE-2026-93622 2026-09-23 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.
CVE-2026-93527 2026-09-23 8.5 High
Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.
CVE-2026-78574 1 Okta 2 Hyperdrive, Okta Hyperdrive Integration Plugin 2026-09-23 7.5 High
The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the context of the host process or elevated installer.
CVE-2026-77420 2026-09-23 5.5 Medium
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1.
CVE-2026-69443 1 Microsoft 6 Windows 10 1809, Windows Server 2019, Windows Server 2019 (server Core Installation) and 3 more 2026-09-23 7.5 High
Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network.
CVE-2026-77422 2026-09-23 7.5 High
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1.