Search
43,411 CVEs
CVEs (43,411, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 451–475 of 43,411 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-51565 | MEDIUM | 6.1 | 2026-07-27 | Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrary web script or HTML via the act… | |
| CVE-2026-61953 | HIGH | 7.2 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions. | |
| CVE-2026-61957 | HIGH | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions. | |
| CVE-2026-65437 | HIGH | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions. | |
| CVE-2026-65438 | HIGH | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions. | |
| CVE-2026-65439 | HIGH | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions. | |
| CVE-2026-65440 | HIGH | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions. | |
| CVE-2026-65441 | HIGH | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions. | |
| CVE-2026-65442 | HIGH | 7.2 | 2026-07-27 | Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions. | |
| CVE-2026-65443 | HIGH | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions. | |
| CVE-2026-65445 | MEDIUM | 6.5 | 2026-07-27 | Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions. | |
| CVE-2026-65446 | HIGH | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions. | |
| CVE-2026-65447 | HIGH | 7.1 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions. | |
| CVE-2026-65448 | MEDIUM | 6.5 | 2026-07-27 | Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker <= 1.8.1 versions. | |
| CVE-2026-66473 | HIGH | 7.5 | 2026-07-27 | Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions. | |
| CVE-2026-17524 | HIGH | Patched | 7.5 | 2026-07-28 | Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker … |
| CVE-2026-17528 | MEDIUM | Patched | 6.1 | 2026-07-28 | Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a malicious payload that is … |
| CVE-2026-12124 | MEDIUM | 5.3 | 2026-07-28 | The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data d… | |
| CVE-2026-14490 | HIGH | 7.5 | 2026-07-28 | The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 0.0.7.… | |
| CVE-2026-14545 | CRITICAL | Patched | 9.8 | 2026-07-28 | The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end account handlers, allowing u… |
| CVE-2026-14819 | LOW | Patched | 3.5 | 2026-07-28 | The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with … |
| CVE-2026-14821 | LOW | Patched | 2.7 | 2026-07-28 | The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level… |
| CVE-2026-14870 | HIGH | Patched | 7.1 | 2026-07-28 | The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an ad… |
| CVE-2026-14924 | HIGH | Patched | 7.5 | 2026-07-28 | The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated us… |
| CVE-2026-14926 | MEDIUM | Patched | 4.2 | 2026-07-28 | The FluentCart A New Era of eCommerce WordPress plugin before 1.4.0 does not verify that a subscription belongs to the requesting customer in several of its payment-method… |