Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (8846 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-65478 2026-07-23 5.4 Medium
Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.
CVE-2026-27355 2 Metaphorcreations, Wordpress 2 Ditty, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.
CVE-2026-65530 2 Templatespare, Wordpress 2 Templatespare, Wordpress 2026-07-23 4.3 Medium
Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.
CVE-2026-65007 1 Getgrav 1 Grav 2026-07-23 9.6 Critical
The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover.
CVE-2026-12082 2026-07-23 7.5 High
The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plugin before 5.0.7 configuration data.
CVE-2026-65055 2026-07-23 5.3 Medium
Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data API endpoints on UserStory, Task, Issue, and Epic viewsets. Attackers can send unauthenticated GET requests to the filters_data endpoints with sequential integer project IDs to enumerate private project membership details including user IDs, full names, and gravatar hashes, bypassing the access controls that correctly restrict other project API endpoints.
CVE-2026-59677 1 Selinux Project 1 Selinux 2026-07-23 N/A
A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in unconfined context This issue affects policycoreutils through 3.10.
CVE-2026-65476 2 Uxper, Wordpress 2 Civi, Wordpress 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.
CVE-2026-57367 2026-07-23 7.1 High
Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.
CVE-2026-57703 2 Sunshinephotocart, Wordpress 2 Sunshine Photo Cart, Wordpress 2026-07-23 6.3 Medium
Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.
CVE-2025-24259 1 Apple 1 Macos 2026-07-23 9.8 Critical
This issue was addressed with additional entitlement checks. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to retrieve Safari bookmarks without an entitlement check.
CVE-2026-27392 2026-07-23 4.3 Medium
Contributor Broken Access Control in uListing <= 2.2.0 versions.
CVE-2026-25466 2 Wordpress, Wpgmaps 2 Wordpress, Wp Go Maps 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.
CVE-2026-27391 2026-07-23 5.4 Medium
Subscriber Broken Access Control in uListing <= 2.2.0 versions.
CVE-2026-27423 2026-07-23 4.3 Medium
Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.
CVE-2026-65469 2026-07-23 5.3 Medium
Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.
CVE-2026-65895 1 Getgrav 1 Grav 2026-07-23 8.5 High
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled.
CVE-2026-7328 1 Caliptra 1 Core Runtime Firmware 2026-07-23 N/A
Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific. This issue affects Core Runtime Firmware: 2.1.0.
CVE-2026-47688 1 Fogproject 1 Fogproject 2026-07-23 8.2 High
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue.
CVE-2026-63141 1 Elastic 1 Kibana 2026-07-23 6.3 Medium
Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints.