Search

Expected end of text, found ':' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (400560 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-103388 1 Misp 1 Misp 2026-09-30 N/A
MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source. When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim. Preconditions: - Attacker must hold galaxy editor privileges (local or via sync). - Victim must view the affected cluster and click the malicious link. Impact: - Stored cross-site scripting (XSS) in the victim's browser. - Potential session theft, credential harvesting, or unauthorized actions within the MISP application. Affected: <2.5.48.
CVE-2026-62540 1 Oracle 2 Cost Management, E-business Suite 2026-09-30 7.2 High
Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-97302 2026-09-30 5.3 Medium
Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
CVE-2026-97301 2026-09-30 6.5 Medium
Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
CVE-2026-97299 2026-09-30 5.4 Medium
Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions.
CVE-2026-97298 2026-09-30 6.5 Medium
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.
CVE-2026-97293 2026-09-30 8.5 High
Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions.
CVE-2026-97292 2026-09-30 6.5 Medium
Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.
CVE-2026-97270 2026-09-30 6.5 Medium
Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.
CVE-2026-97267 2026-09-30 4.3 Medium
Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.
CVE-2026-97266 2026-09-30 6.5 Medium
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.
CVE-2026-97262 2026-09-30 6.5 Medium
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.
CVE-2026-97261 2026-09-30 5.3 Medium
Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions.
CVE-2026-97253 2026-09-30 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.
CVE-2026-97249 2026-09-30 5.3 Medium
Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions.
CVE-2026-97248 2026-09-30 9.8 Critical
Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions.
CVE-2026-97247 2026-09-30 6.5 Medium
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.
CVE-2026-97246 2026-09-30 4.9 Medium
Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions.
CVE-2026-97245 2026-09-30 7.2 High
Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions.
CVE-2026-97244 2026-09-30 7.5 High
Contributor Path Traversal in Creator LMS <= 1.2.19 versions.