Vulnerabilities

Aggregated CVE / GHSA / KEV / OSV — filter by tag and category.

KEV

Categories

All 🌐 Web Application 🧭 Browser 🖥️ Operating System 📱 Mobile 🛰️ Network Infrastructure ☁️ Cloud / Container 📝 CMS / Site Builder 🗄️ Database / Storage 🔐 Auth / Identity 🔑 Cryptography 🛠️ DevOps / CI-CD 🤖 AI / ML 🔌 IoT / Embedded 🧩 Hardware / Firmware 🏢 Enterprise SaaS 🧰 Developer Tooling ☠️ Malicious Package 📦 Other

Tag groups

All 💬 Programming Languages 22 🧱 Web Frameworks 29 📱 Mobile Platforms 6 🤖 AI/ML Frameworks 11 🖥️ Web Servers 9 🗄️ Databases 13 📝 CMS 9 ☁️ Cloud Platforms 11 📦 Container Tech 12 🖥️ Operating Systems 15 ⚔️ Attack Types 25 🧬 CWE 185 🏢 Vendors 581 📦 Products 666 🌳 Package Ecosystems 24 🛠️ DevOps Tools 17 📡 Protocols 15

Popular tags (Top 40)

Rootio Linux419 Microsoft386 C237 Java183 Jre178 Java Min178 Bitnami178 Windows177 Rootdebian11175 Rootdebian12151 Linux130 Cwe 20125 Cwe 78120 Linux Kernel106 Cwe 787105 Apple99 Cwe 41699 Cwe 2296 Rootdebian1393 Cwe 11990 Cisco89 Denial of Service85 Cwe 9484 Multiple Products79 Adobe78 Google77 Cwe 50270 Cwe 7966 Cwe 8954 Apache47 Cwe 91844 Cwe 28443 Oracle42 Cwe 28741 JavaScript41 PHP41 Cwe 7740 Chromium V838 Cwe 30638 Cwe 84337

Filtering: Group: attack-types Clear

ID	Title	Severity	Tags	Detected
CVE-2026-13335	Cross-Site Scripting (XSS) in wordpress (CVE-2026-13335) cross-site scripting in wordpress (CVE-2026-13335). Risk of unauthorized operations or information disclosure.	Medium	WordPress Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-13331	SQL Injection in wordpress (CVE-2026-13331) SQL injection in wordpress (CVE-2026-13331). Confidential information can be exposed externally.	Medium	WordPress SQL Injection Cwe 89	2 months ago
CVE-2026-13333	SQL Injection in wordpress (CVE-2026-13333) SQL injection in wordpress (CVE-2026-13333). Confidential information can be exposed externally.	Medium	WordPress SQL Injection Cwe 89	2 months ago
CVE-2026-50766	Cross-Site Scripting (XSS) in koha (CVE-2026-50766) cross-site scripting in koha (CVE-2026-50766). Risk of unauthorized operations or information disclosure.	Medium	Cross-Site Scripting Cwe 79 Koha	2 months ago
CVE-2026-50767	Cross-Site Scripting (XSS) in koha (CVE-2026-50767) cross-site scripting in koha (CVE-2026-50767). Risk of unauthorized operations or information disclosure.	Medium	Cross-Site Scripting Cwe 79 Koha	2 months ago
CVE-2026-50765	Cross-Site Scripting (XSS) in koha (CVE-2026-50765) cross-site scripting in koha (CVE-2026-50765). Risk of unauthorized operations or information disclosure.	Medium	Cross-Site Scripting Cwe 79 Koha	2 months ago
CVE-2026-36478	Vulnerability in csharp (CVE-2026-36478) vulnerability in csharp (CVE-2026-36478). Risk of unauthorized operations or information disclosure.	High	C# Denial of Service Cwe 400	2 months ago
CVE-2026-36907	Vulnerability in dos (CVE-2026-36907) vulnerability in dos (CVE-2026-36907). Risk of unauthorized operations or information disclosure.	Medium	Denial of Service Cwe 121	2 months ago
CVE-2026-36908	Vulnerability in dos (CVE-2026-36908) vulnerability in dos (CVE-2026-36908). Risk of unauthorized operations or information disclosure.	Medium	Denial of Service Cwe 121	2 months ago
CVE-2026-50016	Vulnerability in pnpm (CVE-2026-50016) vulnerability in pnpm (CVE-2026-50016). Successful exploitation can lead to full system takeover. Exploitable via ``node_modules``. Mitigation: upgrade to `11.4.0` or later.	High	Path Traversal Cwe 23 Pnpm	2 months ago
CVE-2026-55069	Vulnerability in privilege-escalation (CVE-2026-55069) vulnerability in privilege-escalation (CVE-2026-55069). Confidential information can be exposed externally. Mitigation: upgrade to `1.3.24` or later.	High	Privilege Escalation Cwe 916 Kestra	2 months ago
CVE-2026-49869	OS Command Injection in kestra (CVE-2026-49869) OS command injection in kestra (CVE-2026-49869). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `1.0.45` or later.	Critical	Python Remote Code Execution Cwe 78 Cwe 184 +3	2 months ago
CVE-2026-49262	Vulnerability in aimeos/pagible (CVE-2026-49262) vulnerability in aimeos/pagible (CVE-2026-49262). Risk of unauthorized operations or information disclosure. Exploitable via ``cmsproxy``. Mitigation: upgrade to `0.10.4` or later.	Low	Server-Side Request Forgery Cwe 367 Cwe 918	2 months ago
CVE-2026-38639	Vulnerability in dos (CVE-2026-38639) vulnerability in dos (CVE-2026-38639). Risk of unauthorized operations or information disclosure.	High	Denial of Service Cwe 20	2 months ago
CVE-2026-38641	Vulnerability in dos (CVE-2026-38641) vulnerability in dos (CVE-2026-38641). Risk of unauthorized operations or information disclosure.	High	Denial of Service Cwe 404	2 months ago
CVE-2026-32833	OS Command Injection in CVE-2026-32833 (CVE-2026-32833) OS command injection in CVE-2026-32833 (CVE-2026-32833). Successful exploitation can lead to full system takeover.	High	Remote Code Execution Cwe 78	2 months ago
CVE-2026-29509	Path Traversal in path-traversal (CVE-2026-29509) path traversal in path-traversal (CVE-2026-29509). Risk of unauthorized operations or information disclosure.	Medium	Python Path Traversal Cwe 22	2 months ago
CVE-2026-52884	Vulnerability in cpp (CVE-2026-52884) vulnerability in cpp (CVE-2026-52884). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `8.9.6.2` or later.	High	C++ Path Traversal Cwe 42 Notepad Plus Plus +1	2 months ago
CVE-2026-46710	Vulnerability in privilege-escalation (CVE-2026-46710) vulnerability in privilege-escalation (CVE-2026-46710). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `8.9.6` or later.	High	Privilege Escalation Cwe 426 Notepad Plus Plus Notepad	2 months ago
CVE-2026-48802	Vulnerability in python-engineio (CVE-2026-48802) vulnerability in python-engineio (CVE-2026-48802). Risk of unauthorized operations or information disclosure. Exploitable via ``connect``. Mitigation: upgrade to `4.13.2` or later.	High	Python Denial of Service Cwe 770	2 months ago
CVE-2026-48801	Vulnerability in linkify-it (CVE-2026-48801) vulnerability in linkify-it (CVE-2026-48801). Risk of unauthorized operations or information disclosure. Exploitable via ``LinkifyIt.prototype.match``. Mitigation: upgrade to `5.0.1` or later.	High	JavaScript Denial of Service Cwe 1333 Markdown It +1	2 months ago
CVE-2026-52785	SQL Injection in sqli (CVE-2026-52785) SQL injection in sqli (CVE-2026-52785). Confidential information can be exposed externally. Mitigation: upgrade to `17.3.3` or later.	Critical	SQL Injection Cwe 89	2 months ago
CVE-2026-52780	Vulnerability in CVE-2026-52780 (CVE-2026-52780) vulnerability in CVE-2026-52780 (CVE-2026-52780). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `17.3.3` or later.	Critical	Remote Code Execution Cwe 20	2 months ago
CVE-2026-52784	Cross-Site Request Forgery (CSRF) in csrf (CVE-2026-52784) vulnerability in csrf (CVE-2026-52784). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `17.3.3` or later.	High	Cross-Site Request Forgery Cwe 352	2 months ago
CVE-2026-49991	Path Traversal in path-traversal (CVE-2026-49991) path traversal in path-traversal (CVE-2026-49991). Data can be tampered with by attackers.	High	Rust Path Traversal Cwe 22 Cwe 862	2 months ago
CVE-2026-46386	Unsafe Deserialization in rails (CVE-2026-46386) vulnerability in rails (CVE-2026-46386). Successful exploitation can lead to full system takeover.	Critical	Ruby Ruby on Rails Insecure Deserialization Cwe 502 +3	2 months ago
CVE-2026-48090	Use-After-Free in envoy (CVE-2026-48090) vulnerability in envoy (CVE-2026-48090). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `1.37.5` or later.	Medium	Remote Code Execution Denial of Service Cwe 416 Envoyproxy +1	2 months ago
CVE-2026-48753	Vulnerability in github.com/lxc/incus/v7/cmd/incusd (CVE-2026-48753) vulnerability in github.com/lxc/incus/v7/cmd/incusd (CVE-2026-48753). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `7.1.0` or later.	Critical	Path Traversal Cwe 73	2 months ago
CVE-2026-0685	Vulnerability in CVE-2026-0685 (CVE-2026-0685) vulnerability in CVE-2026-0685 (CVE-2026-0685). Successful exploitation can lead to full system takeover.	Critical	Remote Code Execution	2 months ago
CVE-2026-57518	Vulnerability in privilege-escalation (CVE-2026-57518) vulnerability in privilege-escalation (CVE-2026-57518). Successful exploitation can lead to full system takeover.	High	PHP Remote Code Execution Privilege Escalation Cwe 862	2 months ago
CVE-2026-48706	Vulnerability in envoy (CVE-2026-48706) vulnerability in envoy (CVE-2026-48706). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `1.35.13` or later.	Medium	Remote Code Execution Cwe 120 Envoyproxy Envoy	2 months ago
CVE-2026-54341	Out-of-Bounds Read in dos (CVE-2026-54341) vulnerability in dos (CVE-2026-54341). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `1.39.0` or later.	High	Denial of Service Cwe 125	2 months ago
CVE-2026-47221	Vulnerability in envoy (CVE-2026-47221) vulnerability in envoy (CVE-2026-47221). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `1.35.13` or later.	Medium	Denial of Service Cwe 476 Envoyproxy Envoy	2 months ago
CVE-2026-48044	Vulnerability in envoy (CVE-2026-48044) vulnerability in envoy (CVE-2026-48044). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `1.35.11` or later.	High	Denial of Service Cwe 409 Envoyproxy Envoy	2 months ago
CVE-2026-56663	SSRF (Server-Side Request Forgery) in ssrf (CVE-2026-56663) SSRF in ssrf (CVE-2026-56663). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `0.6.52` or later.	High	Server-Side Request Forgery Cwe 918	2 months ago
CVE-2026-28385	SSRF (Server-Side Request Forgery) in ssrf (CVE-2026-28385) SSRF in ssrf (CVE-2026-28385). Risk of unauthorized operations or information disclosure.	Medium	Server-Side Request Forgery Cwe 918 Canonical Lxd	2 months ago
CVE-2025-32394	Vulnerability in dos (CVE-2025-32394) vulnerability in dos (CVE-2025-32394). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `0.6.32` or later.		Denial of Service Cwe 405 Cwe 770	2 months ago
CVE-2025-32423	Vulnerability in dos (CVE-2025-32423) vulnerability in dos (CVE-2025-32423). Risk of unauthorized operations or information disclosure. Mitigation: upgrade to `0.6.32` or later.		Denial of Service Cwe 770	2 months ago
CVE-2026-44160	Vulnerability in fluentd (CVE-2026-44160) vulnerability in fluentd (CVE-2026-44160). Risk of unauthorized operations or information disclosure. Exploitable via ``in_http``. Mitigation: upgrade to `1.19.3` or later.	High	Denial of Service Cwe 409 Fluentd	2 months ago
CVE-2026-44024	Path Traversal in fluentd (CVE-2026-44024) path traversal in fluentd (CVE-2026-44024). Successful exploitation can lead to full system takeover. Exploitable via ``path``. Mitigation: upgrade to `1.19.3` or later.	Critical	Jvn Japan Jpcert Remote Code Execution +3	2 months ago
CVE-2026-9640	Authorization Flaw in privilege-escalation (CVE-2026-9640) vulnerability in privilege-escalation (CVE-2026-9640). Successful exploitation can lead to full system takeover.	High	Privilege Escalation Cwe 863 Canonical Lxd	2 months ago
CVE-2026-9639	Vulnerability in dos (CVE-2026-9639) vulnerability in dos (CVE-2026-9639). Risk of unauthorized operations or information disclosure.	Medium	Denial of Service Cwe 476 Canonical Lxd +2	2 months ago
CVE-2026-57638	Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions. Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.	Medium	Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-57656	Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions. Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions.	Medium	Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-57650	Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions. Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions.	Medium	Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-57651	Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions. Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions.	Medium	Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-57642	Contributor SQL Injection in Gallery <= 4.7.8 versions. Contributor SQL Injection in Gallery <= 4.7.8 versions.	High	SQL Injection Cwe 89	2 months ago
CVE-2026-57643	Contributor SQL Injection in WP Post Author <= 3.9.1 versions. Contributor SQL Injection in WP Post Author <= 3.9.1 versions.	High	SQL Injection Cwe 89	2 months ago
CVE-2026-57644	Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions. Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions.	High	SQL Injection Cwe 89	2 months ago
CVE-2026-57653	Contributor SQL Injection in WP Job Portal <= 2.5.2 versions. Contributor SQL Injection in WP Job Portal <= 2.5.2 versions.	High	SQL Injection Cwe 89	2 months ago

Vulnerabilities

🍪 About cookies