Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (72449 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-69084 2 Gt3themes, Wordpress 2 Photo Gallery, Wordpress 2026-01-08 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GT3 themes Photo Gallery allows Reflected XSS.This issue affects Photo Gallery: from n/a through 2.7.7.26.
CVE-2025-32300 2 Digitalzoomstudio, Wordpress 2 Video Gallery, Wordpress 2026-01-08 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital zoom studio DZS Video Gallery allows Reflected XSS.This issue affects DZS Video Gallery: from n/a through 12.25.
CVE-2025-47356 1 Qualcomm 1 Snapdragon 2026-01-08 7.8 High
Memory Corruption when multiple threads concurrently access and modify shared resources.
CVE-2025-69081 1 Wordpress 1 Wordpress 2026-01-08 8.1 High
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Group Hope charity-is-hope allows PHP Local File Inclusion.This issue affects Hope: from n/a through 3.0.0.
CVE-2025-69082 1 Wordpress 1 Wordpress 2026-01-08 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects Arlo: from n/a through 6.0.3.
CVE-2025-47348 1 Qualcomm 1 Snapdragon 2026-01-08 7.8 High
Memory corruption while processing identity credential operations in the trusted application.
CVE-2025-13371 1 Wordpress 1 Wordpress 2026-01-08 8.6 High
The MoneySpace plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.9. This is due to the plugin storing full payment card details (PAN, card holder name, expiry month/year, and CVV) in WordPress post_meta using base64_encode(), and then embedding these values into the publicly accessible mspaylink page's inline JavaScript without any authentication or authorization check. This makes it possible for unauthenticated attackers who know or can guess an order_id to access the mspaylink endpoint and retrieve full credit card numbers and CVV codes directly from the HTML/JS response, constituting a severe PCI-DSS violation.
CVE-2025-61939 2026-01-08 8.8 High
An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local network with admin access to the web server, and the ability to manipulate DNS responses, can redirect the SSH connection to an attacker controlled device.
CVE-2025-4676 1 Abb 2 Webpro Snmp Card Powervalue, Webpro Snmp Card Powervalue Ul 2026-01-08 8.8 High
Incorrect Implementation of Authentication Algorithm vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerValue: through 1.1.8.K; WebPro SNMP Card PowerValue UL: through 1.1.8.K.
CVE-2025-47380 1 Qualcomm 1 Snapdragon 2026-01-08 7.8 High
Memory corruption while preprocessing IOCTLs in sensors.
CVE-2025-47393 1 Qualcomm 1 Snapdragon 2026-01-08 7.8 High
Memory corruption when accessing resources in kernel driver.
CVE-2025-47345 1 Qualcomm 1 Snapdragon 2026-01-08 8.4 High
Cryptographic issue may occur while encrypting license data.
CVE-2025-15158 1 Wordpress 1 Wordpress 2026-01-08 8.8 High
The WP Enable WebP plugin for WordPress is vulnerable to arbitrary file uploads due to improper file type validation in the 'wpse_file_and_ext_webp' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVE-2025-46494 1 Wordpress 1 Wordpress 2026-01-08 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit Pro allows Reflected XSS.This issue affects WidgetKit Pro: from n/a through 1.13.1.
CVE-2025-47394 1 Qualcomm 1 Snapdragon 2026-01-08 7.8 High
Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations.
CVE-2025-65805 1 Openairinterface 1 Cn5g Amf 2026-01-08 7.5 High
OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer than 1000 to AMF.
CVE-2025-66620 2026-01-08 8 High
An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories. An attacker with admin access to MicroServer can gain limited shell access, enabling persistence through reverse shells, and the ability to modify or remove data stored in the file system.
CVE-2025-47388 1 Qualcomm 1 Snapdragon 2026-01-08 7.8 High
Memory corruption while passing pages to DSP with an unaligned starting address.
CVE-2025-47339 1 Qualcomm 1 Snapdragon 2026-01-08 7.8 High
Memory corruption while deinitializing a HDCP session.
CVE-2025-13493 1 Wordpress 1 Wordpress 2026-01-08 7.5 High
The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4. This is due to missing authorization and nonce validation in the rnd_handle_form_submit function hooked to both admin_post_my_simple_form and admin_post_nopriv_my_simple_form actions. This makes it possible for unauthenticated attackers to export complete user details (excluding passwords and sensitive tokens) in CSV format via the 'action' parameter.