Search

Expected end of text, found ':' (at char 25), (line:1, col:26)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (400197 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-69355 1 Microsoft 6 Exchange Server, Exchange Server 2016, Exchange Server 2019 and 3 more 2026-09-30 8.8 High
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
CVE-2026-69356 1 Microsoft 5 Exchange Server, Exchange Server 2016, Exchange Server 2019 and 2 more 2026-09-30 9.3 Critical
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-102385 2026-09-30 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
CVE-2026-102384 2026-09-30 5.9 Medium
Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.
CVE-2026-100513 2026-09-30 6.5 Medium
Contributor Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.5 versions.
CVE-2026-100508 2026-09-30 5.3 Medium
Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.
CVE-2026-100507 2026-09-30 7.1 High
Unauthenticated Cross Site Scripting (XSS) in If-So Dynamic Content Personalization <= 1.10.1 versions.
CVE-2026-97289 2026-09-30 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.2.6 versions.
CVE-2026-97288 2026-09-30 6.5 Medium
Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.
CVE-2026-97287 2026-09-30 8.5 High
Contributor SQL Injection in Event Tickets <= 5.29.5 versions.
CVE-2026-97286 2026-09-30 6.5 Medium
Contributor Cross Site Scripting (XSS) in Strong Testimonials <= 3.3.11 versions.
CVE-2026-97285 2026-09-30 5.4 Medium
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
CVE-2026-97282 2026-09-30 5.3 Medium
Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.
CVE-2026-97279 2026-09-30 6.5 Medium
Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.
CVE-2026-97274 2026-09-30 9.8 Critical
Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions.
CVE-2026-97272 2026-09-30 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.
CVE-2026-97271 2026-09-30 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
CVE-2026-97250 2026-09-30 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
CVE-2026-91206 1 Apache 1 Roller 2026-09-30 6.1 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perform reflected cross-site scripting through the optional LDAP comment authenticator, which writes request parameter values into its HTML form without escaping. This affects only sites configured to use LdapCommentAuthenticator, and a victim whose session has already loaded the authenticator form must follow a crafted link. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which escapes the reflected values.
CVE-2026-91204 1 Apache 1 Roller 2026-09-30 6.1 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an anonymous remote attacker to store a comment containing a javascript: URI link that survives HTML comment formatting and can execute script in the browser of a visitor who clicks it. This affects only sites that enable HTML in comments (users.comments.htmlenabled=true) together with the HTMLSubset comment formatter; comment moderation, where enabled, delays publication. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which restricts restored links to http, https and mailto URIs.