Export limit exceeded: 95206 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 47437 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (47437 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2025-62973 2 Themekraft, Wordpress 2 Buddyforms, Wordpress 2026-10-06 5.3 Medium
Missing Authorization vulnerability in Themekraft BuddyForms buddyforms allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects BuddyForms: from n/a through 2.10.2.
CVE-2026-97309 2026-10-06 N/A
Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226.
CVE-2026-97303 2026-10-06 7.6 High
Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests: from n/a through 3.0.2.
CVE-2026-39789 2026-10-06 7.5 High
Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.
CVE-2026-39749 2026-10-06 6.5 Medium
Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.
CVE-2026-39599 2026-10-06 4.3 Medium
Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.
CVE-2026-32581 2026-10-06 7.1 High
Subscriber SQL Injection in Mooberry Book Manager 4.16.2 versions.
CVE-2026-32580 2026-10-06 7.5 High
Unauthenticated SQL Injection in WooCommerce Lottery <= 2.2.9 versions.
CVE-2026-32578 2026-10-06 7.1 High
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
CVE-2026-25434 2026-10-06 8.5 High
Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions.
CVE-2026-25433 2026-10-06 7.1 High
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
CVE-2026-105072 2026-10-06 7.5 High
Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.
CVE-2026-104389 2026-10-06 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This issue affects Sirv: from n/a through 8.2.5.
CVE-2026-104386 2026-10-06 6.5 Medium
Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3.
CVE-2026-103355 2 Unlimited-elements, Wordpress-extensions 2 Unlimited Elements For Elementor (free Widgets, Addons, Templates), Unlimited Elements For Elementor 2026-10-06 9.3 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
CVE-2026-103337 2026-10-06 6.5 Medium
Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2.
CVE-2026-103086 2026-10-06 6.5 Medium
Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through 1.2.74.
CVE-2026-103066 2026-10-06 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.4.0.
CVE-2026-104052 2 Itsourcecode, Sourcecodester 2 Pet Shop Management System, Petshop Management System 2026-10-06 6.3 Medium
A vulnerability was determined in itsourcecode Pet Shop Management System 1.0. The affected element is an unknown function of the file admin_reject_completed.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-103762 2 B3log, Siyuan 2 Siyuan, Siyuan 2026-10-06 5.3 Medium
SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attackers with read-only or anonymous publish access can POST any open notebook ID to receive the global save-box ID and save-path template, revealing a hidden notebook's existence and creation time.