Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (3864 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-118077 2026-10-30 7.2 High
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
CVE-2026-118074 2026-10-30 7.2 High
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
CVE-2026-118073 2026-10-30 8.8 High
Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
CVE-2026-116869 2026-10-30 7.2 High
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
CVE-2026-116866 2026-10-30 8.8 High
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
CVE-2026-116865 2026-10-30 7.2 High
Editor PHP Object Injection in Zippy <= 1.7.0 versions.
CVE-2026-116864 2026-10-30 7.2 High
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
CVE-2026-61803 1 Frappe 1 Lms 2026-10-30 N/A
Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, the `course/certificate checkout` flow accepts client-controlled pricing, allowing an authenticated user to complete a paid-course or certificate purchase for an amount other than the actual price. This is a business-logic integrity issue; it does not expose other users' data or grant elevated privileges. This issue is fixed in version 2.52.1.
CVE-2026-119526 2026-10-30 9.8 Critical
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.
CVE-2026-118090 2026-10-30 8.8 High
Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.
CVE-2026-118089 2026-10-30 7.2 High
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
CVE-2026-90888 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
CVE-2026-78527 2026-10-30 8.8 High
Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.
CVE-2026-73186 2026-10-30 8.8 High
Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.
CVE-2026-39738 2026-10-30 9.8 Critical
Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.
CVE-2026-93327 2026-10-30 N/A
A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was patched on 11 September 2026, and no customer action is needed.
CVE-2026-104324 2 Ibm, Langflow 2 Langflow Oss, Langflow 2026-10-30 8.8 High
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to deserialization of untrusted data.
CVE-2026-104317 2 Ibm, Langflow 2 Langflow Oss, Langflow 2026-10-30 8.1 High
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker who could reach the message broker to execute arbitrary code on the system due to the deserialization of untrusted data.
CVE-2026-107238 2026-10-30 N/A
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service.
CVE-2023-22793 2026-10-30 N/A
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center.