Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (3757 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-102455 1 Digiwin 1 Easyflow .net 2026-09-30 9.8 Critical
EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content.
CVE-2026-100843 1 Project-monai 1 Monai 2026-09-30 7.8 High
MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() deserialization in monai/auto3dseg/utils.py. Attackers can craft malicious pickle files that execute arbitrary system commands when deserialized by the vulnerable function.
CVE-2026-100308 1 Aws 1 Gluonts 2026-09-30 7.8 High
Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to execute arbitrary operating system commands with the privileges of the loading process via a crafted serialized model directory. To remediate this issue, users should upgrade to version 0.17.0 or later.
CVE-2026-97248 2026-09-30 9.8 Critical
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
CVE-2026-96833 2026-09-30 7.2 High
Editor PHP Object Injection in Ultimate Addons for Contact Form 7 <= 3.5.51 versions.
CVE-2026-96832 2026-09-30 7.2 High
Shop manager PHP Object Injection in Content Egg <= 6.3.1 versions.
CVE-2026-96831 2026-09-30 8.8 High
Contributor PHP Object Injection in Themify Builder <= 7.8.1 versions.
CVE-2026-96344 2026-09-30 7.2 High
Custom role PHP Object Injection in eCommerce Product Catalog <= 3.6.0 versions.
CVE-2026-96343 2026-09-30 7.2 High
Custom role PHP Object Injection in WP ERP <= 1.17.9 versions.
CVE-2026-95531 2026-09-30 8.8 High
Subscriber PHP Object Injection in Conversational Forms for ChatBot <= 1.5.0 versions.
CVE-2026-94683 2026-09-30 8.8 High
Contributor PHP Object Injection in DesignSetGo <= 2.8.0 versions.
CVE-2026-94678 2026-09-30 8.8 High
Contributor PHP Object Injection in Go Live Update Urls <= 7.0.8 versions.
CVE-2026-94677 2026-09-30 7.2 High
Shop manager PHP Object Injection in Kadence WooCommerce Email Designer <= 1.5.19.1 versions.
CVE-2026-94122 2026-09-30 7.2 High
Editor PHP Object Injection in Responsive Slider Gallery <= 1.5.5 versions.
CVE-2026-94121 2026-09-30 8.8 High
Contributor PHP Object Injection in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 versions.
CVE-2026-94076 2026-09-30 8.8 High
Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.
CVE-2026-93771 2026-09-30 7.2 High
Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.
CVE-2026-93651 2026-09-30 7.2 High
Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.
CVE-2026-93624 2026-09-30 7.2 High
Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.
CVE-2026-91051 2026-09-30 6.6 Medium
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .