Export limit exceeded: 107784 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (107784 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-94175 2026-10-30 7.1 High
Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.
CVE-2026-78527 2026-10-30 8.8 High
Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.
CVE-2026-73186 2026-10-30 8.8 High
Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.
CVE-2026-54855 2026-10-30 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.
CVE-2026-48201 2026-10-30 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.
CVE-2026-39786 2026-10-30 7.1 High
Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.
CVE-2026-39734 2026-10-30 7.5 High
Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.
CVE-2026-28160 2026-10-30 7.1 High
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.
CVE-2026-91219 1 Oracle 1 Soa Suite 2026-10-30 8.6 High
Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVE-2024-12397 1 Redhat 13 Amq Streams, Apache Camel Hawtio, Build Keycloak and 10 more 2026-10-30 7.4 High
A flaw was found in Quarkus-HTTP, which incorrectly parses cookies with certain value-delimiting characters in incoming requests. This issue could allow an attacker to construct a cookie value to exfiltrate HttpOnly cookie values or spoof arbitrary additional cookie values, leading to unauthorized data access or modification. The main threat from this flaw impacts data confidentiality and integrity.
CVE-2026-61854 2026-10-30 8.2 High
VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In `report_buffer.py`, `_maybe_cleanup()` uses an unlocked dictionary for once-per-hour cleanup throttling, allowing simultaneous `_cleanup_tenant()` operations for one tenant. Cleanup reads `transcripts.jsonl` and rewrites it in place without file locking or atomic replacement, while `report_buffer_append_async` uses `asyncio.to_thread` to append without synchronization. In `main.py`, concurrent `_processing_worker` tasks make this reachable in normal operation; `processing.worker_count` of two or more and public-pool servers sharing a `server_key` increase collisions. With `report_buffer.enabled` set to true, racing writes can lose, duplicate or corrupt transcript data and defeat `report_buffer.retention_seconds` pruning, allowing unbounded disk growth that can exhaust storage and crash the host or other services sharing it. The feature is opt-in and disabled by default. This issue is fixed in version 3.3.1.
CVE-2026-9536 1 Vtk 1 Vtk 2026-10-30 7.5 High
A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2026-9535 1 Vtk 1 Vtk 2026-10-30 8.2 High
A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability.
CVE-2026-96203 1 Microsoft 2 Edge Chromium, Microsoft Edge (chromium-based) 2026-10-30 8.8 High
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-96199 1 Microsoft 2 Edge Chromium, Microsoft Edge (chromium-based) 2026-10-30 8.8 High
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-96198 1 Microsoft 2 Edge Chromium, Microsoft Edge (chromium-based) 2026-10-30 8.8 High
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-96196 1 Microsoft 2 Edge Chromium, Microsoft Edge (chromium-based) 2026-10-30 8.8 High
Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-96192 1 Microsoft 2 Edge Chromium, Microsoft Edge (chromium-based) 2026-10-30 8.8 High
Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.
CVE-2026-90869 2 Progress, Progress Software 2 Ws Ftp Server, Ws Ftp Server 2026-10-30 7.5 High
A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows.
CVE-2026-90867 2 Progress, Progress Software 2 Ws Ftp Server, Ws Ftp Server 2026-10-30 8.1 High
Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could expose administrative functionality to remote authentication attempts.