Search

Expected end of text, found ':' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (358617 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-67990 2026-08-13 5.4 Medium
basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management endpoints, such as creating an Alertmanager silence or requesting a Prometheus reload. The final impact depends on the APIs enabled by the upstream services.
CVE-2026-67986 2026-08-13 8.4 High
amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application path that allows an attacker to influence dynamic method names.
CVE-2026-66878 1 Redhat 2 Acm, Advanced Cluster Management For Kubernetes 2026-08-13 7.7 High
A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel and Subscription resources, can exploit this vulnerability. By manipulating the Channel.Spec.SecretRef.Namespace field, the user can cause the system to copy sensitive Secret contents from other namespaces into their own, leading to information disclosure.
CVE-2026-66704 2026-08-13 7.2 High
Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.
CVE-2026-66700 2026-08-13 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.
CVE-2026-66698 2026-08-13 7.1 High
Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.
CVE-2026-66697 2026-08-13 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
CVE-2026-66693 2026-08-13 6.5 Medium
Subscriber Broken Access Control in Motors <= 1.4.113 versions.
CVE-2026-66691 2026-08-13 9.8 Critical
Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
CVE-2026-66689 2026-08-13 6.3 Medium
Unauthenticated Broken Access Control in Anti Spam and list cleaner &#8211; AcyChecker <= 2.0.0 versions.
CVE-2026-66687 2026-08-13 6.5 Medium
Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.
CVE-2026-66661 2026-08-13 7.7 High
Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.
CVE-2026-66660 2026-08-13 6.5 Medium
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.
CVE-2026-66658 2026-08-13 8.5 High
Subscriber SQL Injection in Reviewer <= 3.14.2 versions.
CVE-2026-66657 2026-08-13 8.1 High
Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.
CVE-2026-66656 2026-08-13 8.1 High
Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.
CVE-2026-66655 2026-08-13 7.1 High
Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.
CVE-2026-66654 2026-08-13 6 Medium
Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.
CVE-2026-66653 2026-08-13 8.1 High
Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions.
CVE-2026-66478 2026-08-13 9.3 Critical
Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions.