Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (11469 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-57498 1 Coollabsio 1 Coolify 2026-06-30 9.6 Critical
Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any operation. However, multiple Livewire web UI components accept server_id and destination_uuid from URL query parameters without any team ownership validation, allowing cross-team resource deployment. This vulnerability is fixed in 4.0.0-beta.474.
CVE-2026-57954 1 Elide 1 Elide 2026-06-30 4.3 Medium
Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row ordering analysis, leaking relative field ordering across all rows via both JSON:API and GraphQL read paths.
CVE-2026-56768 1 Haiwen 1 Seahub 2026-06-30 8.8 High
Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a fileserver zip token and download entire shared directory trees.
CVE-2026-57340 2 Shoheitanaka, Wordpress 2 Japanized For Woocommerce, Wordpress 2026-06-29 6.5 Medium
Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions.
CVE-2026-57327 2 Mainwp, Wordpress 2 Mainwp, Wordpress 2026-06-29 6.3 Medium
Subscriber Broken Access Control in MainWP <= 6.1.1 versions.
CVE-2026-57332 2 Wordpress, Wpswings 2 Wordpress, Wallet System For Woocommerce 2026-06-29 7.1 High
Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions.
CVE-2026-57334 2 Wedevs, Wordpress 2 Wp User Frontend, Wordpress 2026-06-29 6.5 Medium
Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.
CVE-2025-63041 2 Codeamp, Wordpress 2 Forget About Shortcode Buttons, Wordpress 2026-06-29 5.4 Medium
Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.
CVE-2025-63078 2 Jetmonsters, Wordpress 2 Restaurant Menu By Motopress, Wordpress 2026-06-29 4.3 Medium
Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.
CVE-2025-63079 2 Bdthemes, Wordpress 2 Live Copy Paste For Elementor, Wordpress 2026-06-29 4.3 Medium
Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.
CVE-2025-64636 2 Rhewlif, Wordpress 2 Donation Thermometer, Wordpress 2026-06-29 5.3 Medium
Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.
CVE-2026-54835 2 Rustaurius, Wordpress 2 Five Star Restaurant Menu, Wordpress 2026-06-29 7.5 High
Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.
CVE-2026-54837 2 Syed Balkhi, Wordpress 2 Intranet & Private Site – All-in-one Intranet, Wordpress 2026-06-29 7.5 High
Unauthenticated Broken Access Control in Intranet &amp; Private Site &#8211; All-In-One Intranet <= 1.8.1 versions.
CVE-2026-54846 2 Akosglys, Wordpress 2 Syncee Premium Dropshipping & Wholesale, Wordpress 2026-06-29 7.5 High
Unauthenticated Broken Access Control in Syncee Premium Dropshipping &amp; Wholesale <= 1.0.27 versions.
CVE-2026-56025 2 Paymob, Wordpress 2 Paymob For Woocommerce, Wordpress 2026-06-29 7.5 High
Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.
CVE-2026-56038 2 Frisbii, Wordpress 2 Frisbii Pay, Wordpress 2026-06-29 8.8 High
Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.
CVE-2026-56063 2 Bplugins, Wordpress 2 Mailchimp Block, Wordpress 2026-06-29 8.3 High
Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.
CVE-2026-57323 2 Bplugins, Wordpress 2 Flash & Html5 Video, Wordpress 2026-06-29 5.8 Medium
Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.
CVE-2026-57430 2 Seopress Free, Wordpress 2 Seopress Pro, Wordpress 2026-06-29 4.3 Medium
Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.
CVE-2026-11364 2 Dornaweb, Wordpress 2 Product Specifications For Woocommerce, Wordpress 2026-06-29 4.3 Medium
The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized modification, creation, and deletion of data in versions up to and including 0.8.9. This is due to a missing capability check and missing nonce verification in the __invoke() methods of the AttributeGroupController and AttributeController classes, which are bound to the 'dwps_modify_groups' and 'dwps_modify_attributes' AJAX actions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create, edit, and delete arbitrary product specification groups and attributes (taxonomy terms in the 'spec-group' and attribute taxonomies), corrupting business data and impacting the site's frontend display.