Export limit exceeded: 361449 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 361449 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 361449 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found '\' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (361449 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-57429 2 Elightup, Wordpress 2 Slim Seo, Wordpress 2026-06-26 6.5 Medium
Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.
CVE-2026-54836 2 Wordpress, Ymc 2 Wordpress, Ymc Filter 2026-06-26 9.3 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5.
CVE-2026-2815 1 Silicon Labs 1 Sisdk 2026-06-26 N/A
Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys
CVE-2026-4526 1 Silicon Labs 1 Emberznet 2026-06-26 N/A
In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed.
CVE-2026-56122 1 Rickknowles 1 Winstone Servlet Container 2026-06-26 7.5 High
Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GET requests with dot-dot-slash sequences that are not sanitized when serving static files from the configured webroot. Attackers can traverse outside the webroot directory using traversal-prefixed paths in a single HTTP request to read any file accessible to the servlet engine process, including sensitive system files when the service runs with elevated privileges.
CVE-2026-47145 1 Silicon Labs 1 Emberznet 2026-06-26 N/A
In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.
CVE-2026-47146 1 Silicon Labs 1 Emberznet 2026-06-26 N/A
In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.
CVE-2026-47147 1 Silicon Labs 1 Emberznet 2026-06-26 N/A
In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has already joined the network. Only devices supporting the OTA Server cluster may be impacted.
CVE-2026-47148 1 Silicon Labs 1 Emberznet 2026-06-26 N/A
In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Groups cluster may be impacted.
CVE-2026-47149 1 Silicon Labs 1 Emberznet 2026-06-26 N/A
In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Door Lock cluster may be impacted.
CVE-2026-47150 1 Silicon Labs 1 Emberznet 2026-06-26 N/A
In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited. These messages must come from a device that has already joined the network. Only devices supporting the IAS Zone cluster may be impacted.
CVE-2026-47151 1 Silicon Labs 1 Emberznet 2026-06-26 N/A
In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location of this data is limited. These messages must come from a device that has already joined the network. Only devices supporting the Door Lock cluster may be impacted.
CVE-2026-47152 1 Silicon Labs 1 Emberznet 2026-06-26 N/A
In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.
CVE-2026-47153 1 Silicon Labs 1 Emberznet 2026-06-26 N/A
In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.
CVE-2026-47154 1 Silicon Labs 1 Emberznet 2026-06-26 N/A
In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Simple Metering cluster may be impacted.
CVE-2026-6432 1 Silicon Labs 1 Sisdk 2026-06-26 N/A
Improper bounds validation in EmberZNet SDK versions 9.0.2 and earlier may result in crashes or dynamic memory leakage.
CVE-2026-13314 1 Pretix 1 Pretix-digital 2026-06-26 N/A
Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.
CVE-2026-13223 1 Pretix 1 Pretix-computop 2026-06-26 N/A
Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
CVE-2026-13222 1 Pretix 1 Pretix-oppwa 2026-06-26 N/A
Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.
CVE-2026-57536 1 Pretix 1 Pretix-mollie 2026-06-26 N/A
Our payment integration with Mollie did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment.