Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (3872 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-61992 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
CVE-2026-54860 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
CVE-2026-54857 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
CVE-2026-54856 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
CVE-2026-42701 2026-10-30 7.2 High
Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
CVE-2026-118079 2026-10-30 7.2 High
Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.
CVE-2026-118078 2026-10-30 7.2 High
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
CVE-2026-118077 2026-10-30 7.2 High
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
CVE-2026-118074 2026-10-30 7.2 High
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
CVE-2026-118073 2026-10-30 8.8 High
Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
CVE-2026-116869 2026-10-30 7.2 High
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
CVE-2026-116866 2026-10-30 8.8 High
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
CVE-2026-116865 2026-10-30 7.2 High
Editor PHP Object Injection in Zippy <= 1.7.0 versions.
CVE-2026-116864 2026-10-30 7.2 High
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
CVE-2026-61803 1 Frappe 1 Lms 2026-10-30 N/A
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.
CVE-2026-119526 2026-10-30 9.8 Critical
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.
CVE-2026-90888 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
CVE-2026-104324 2 Ibm, Langflow 2 Langflow Oss, Langflow 2026-10-30 8.8 High
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.
CVE-2026-104317 2 Ibm, Langflow 2 Langflow Oss, Langflow 2026-10-30 8.1 High
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.
CVE-2026-59396 1 Cloudfoundry 2 Cf-deployment, Uaa 2026-10-30 4.9 Medium
A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites (write access to clients or a compromised endpoint) can send anonymous requests that force repeated parsing of large cached objects, causing excessive CPU usage and potential Java heap exhaustion via OutOfMemoryError, resulting in service unavailability.