Export limit exceeded: 10551 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (10551 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-61998 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
CVE-2026-61997 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
CVE-2026-61992 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
CVE-2026-54860 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.
CVE-2026-54857 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.
CVE-2026-54856 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.
CVE-2026-42701 2026-10-30 7.2 High
Shop manager PHP Object Injection in YayMail <= 4.4.6 versions.
CVE-2026-21811 1 Hcltech 1 Appscan Integration With Azure Boards For Asoc & A360 2026-10-30 3.8 Low
HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface.
CVE-2026-118079 2026-10-30 7.2 High
Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.
CVE-2026-118078 2026-10-30 7.2 High
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
CVE-2026-118077 2026-10-30 7.2 High
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
CVE-2026-118074 2026-10-30 7.2 High
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
CVE-2026-118073 2026-10-30 8.8 High
Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
CVE-2026-116869 2026-10-30 7.2 High
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
CVE-2026-116866 2026-10-30 8.8 High
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
CVE-2026-116865 2026-10-30 7.2 High
Editor PHP Object Injection in Zippy <= 1.7.0 versions.
CVE-2026-116864 2026-10-30 7.2 High
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
CVE-2026-114221 1 Newtype Infortech 1 Nt Oneapp 2026-10-30 7.4 High
NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user.
CVE-2026-59388 2026-10-30 6.5 Medium
Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events.
CVE-2026-61803 1 Frappe 1 Lms 2026-10-30 N/A
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.