Vulnerabilities

Aggregated CVE / GHSA / KEV / OSV — filter by tag and category.

KEV

Categories

All 🌐 Web Application 🧭 Browser 🖥️ Operating System 📱 Mobile 🛰️ Network Infrastructure ☁️ Cloud / Container 📝 CMS / Site Builder 🗄️ Database / Storage 🔐 Auth / Identity 🔑 Cryptography 🛠️ DevOps / CI-CD 🤖 AI / ML 🔌 IoT / Embedded 🧩 Hardware / Firmware 🏢 Enterprise SaaS 🧰 Developer Tooling ☠️ Malicious Package 📦 Other

Tag groups

All 💬 Programming Languages 22 🧱 Web Frameworks 29 📱 Mobile Platforms 6 🤖 AI/ML Frameworks 11 🖥️ Web Servers 9 🗄️ Databases 13 📝 CMS 9 ☁️ Cloud Platforms 11 📦 Container Tech 12 🖥️ Operating Systems 15 ⚔️ Attack Types 25 🧬 CWE 185 🏢 Vendors 581 📦 Products 666 🌳 Package Ecosystems 24 🛠️ DevOps Tools 17 📡 Protocols 15

Popular tags (Top 40)

Rootio Linux419 Microsoft386 C237 Java183 Jre178 Java Min178 Bitnami178 Windows177 Rootdebian11175 Rootdebian12151 Linux130 Cwe 20125 Cwe 78120 Linux Kernel106 Cwe 787105 Apple99 Cwe 41699 Cwe 2296 Rootdebian1393 Cwe 11990 Cisco89 Denial of Service85 Cwe 9484 Multiple Products79 Adobe78 Google77 Cwe 50270 Cwe 7966 Cwe 8954 Apache47 Cwe 91844 Cwe 28443 Oracle42 Cwe 28741 JavaScript41 PHP41 Cwe 7740 Chromium V838 Cwe 30638 Cwe 84337

Filtering: Group: attack-types Clear

ID	Title	Severity	Tags	Detected
CVE-2026-46910	Vulnerability in c (CVE-2026-46910) vulnerability in c (CVE-2026-46910). Confidential information can be exposed externally.	Critical	C Denial of Service Cwe 20 Cwe 200 +5	3 weeks ago
CVE-2026-46901	Privilege Escalation in c (CVE-2026-46901) vulnerability in c (CVE-2026-46901). Confidential information can be exposed externally.	Critical	C Denial of Service Cwe 269 Cwe 284 +2	3 weeks ago
CVE-2026-46897	Vulnerability in c (CVE-2026-46897) vulnerability in c (CVE-2026-46897). Confidential information can be exposed externally.	Critical	C Denial of Service Cwe 284 Oracle +1	3 weeks ago
CVE-2026-46872	Vulnerability in c (CVE-2026-46872) vulnerability in c (CVE-2026-46872). Data can be tampered with by attackers.	Critical	C Denial of Service Cwe 284 Oracle +1	3 weeks ago
CVE-2026-46858	Vulnerability in c (CVE-2026-46858) vulnerability in c (CVE-2026-46858). Data can be tampered with by attackers.	Critical	C Denial of Service Cwe 284 Oracle +1	3 weeks ago
CVE-2026-20181	Path Traversal in Cisco dos (CVE-2026-20181) path traversal in Cisco dos (CVE-2026-20181). Successful exploitation can lead to full system takeover.	Critical	Cisco Network Denial of Service Cwe 22 +2	3 weeks ago
CVE-2026-47103	Vulnerability in python-statemachine (CVE-2026-47103) vulnerability in python-statemachine (CVE-2026-47103). Successful exploitation can lead to full system takeover. Exploitable via ``SCXMLProcessor``. Mitigation: upgrade to `3.2.0` or later.	Critical	Python Remote Code Execution Cwe 95 Cwe 94 +2	3 weeks ago
CVE-2026-48055	Vulnerability in path-traversal (CVE-2026-48055) vulnerability in path-traversal (CVE-2026-48055). Data can be tampered with by attackers.	Critical	Path Traversal Cwe 20 Cwe 22	3 weeks ago
CVE-2026-0126	Out-of-Bounds Write in google (CVE-2026-0126) out-of-bounds write in google (CVE-2026-0126). Successful exploitation can lead to full system takeover.	Critical	Remote Code Execution Cwe 787 Google Android +1	3 weeks ago
CVE-2026-48746	Vulnerability in vllm (CVE-2026-48746) vulnerability in vllm (CVE-2026-48746). Confidential information can be exposed externally. Exploitable via ``AuthenticationMiddleware``. Mitigation: upgrade to `0.22.0` or later.	Critical	Authentication Bypass Cwe 444 vLLM Cwe 501	3 weeks ago
CVE-2026-48519	Code Injection in langflow (CVE-2026-48519) code injection in langflow (CVE-2026-48519). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `1.9.2` or later.	Critical	Python Remote Code Execution Cwe 94 Langflow	3 weeks ago
CVE-2026-52715	Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions. Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.	Critical	WordPress SQL Injection Cwe 89	3 weeks ago
CVE-2026-39574	Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions. Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-49772	SQL Injection in sqli (CVE-2026-49772) SQL injection in sqli (CVE-2026-49772). Confidential information can be exposed externally.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-52693	Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions. Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-52703	Unauthenticated Path Traversal in FastDup <= 2.7.2 versions. Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.	Critical	Path Traversal Cwe 35	3 weeks ago
CVE-2026-49776	SQL Injection in wordpress (CVE-2026-49776) SQL injection in wordpress (CVE-2026-49776). Confidential information can be exposed externally.	Critical	WordPress SQL Injection Cwe 89	3 weeks ago
CVE-2026-49067	Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions. Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-48886	Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions. Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.	Critical	JavaScript SQL Injection Cwe 89	3 weeks ago
CVE-2026-45439	Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions. Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-48836	Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions. Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.	Critical	Remote Code Execution Cwe 94	3 weeks ago
CVE-2026-42665	Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions. Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-42639	Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions. Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-40771	Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions. Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-42381	Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions. Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-40798	Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions. Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-42386	Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions. Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-39530	Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions. Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-39583	Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions. Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.	Critical	Privilege Escalation Cwe 266	3 weeks ago
CVE-2026-39502	Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions. Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-39519	Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions. Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-39493	Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions. Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-39512	Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions. Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-39511	Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions. Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-39492	Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions. Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-39465	Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions. Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.	Critical	Remote Code Execution Cwe 94	3 weeks ago
CVE-2026-34901	Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions. Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.	Critical	Privilege Escalation Cwe 266	3 weeks ago
CVE-2026-39441	Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions. Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-50890	SQL Injection in sqli (CVE-2026-50890) SQL injection in sqli (CVE-2026-50890). Successful exploitation can lead to full system takeover.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-50887	SSRF (Server-Side Request Forgery) in ssrf (CVE-2026-50887) SSRF in ssrf (CVE-2026-50887). Confidential information can be exposed externally.	Critical	Server-Side Request Forgery Cwe 918	3 weeks ago
CVE-2026-49952	Vulnerability in CVE-2026-49952 (CVE-2026-49952) vulnerability in CVE-2026-49952 (CVE-2026-49952). Confidential information can be exposed externally.	Critical	PHP Authentication Bypass Cwe 323	3 weeks ago
CVE-2026-50869	Path Traversal in path-traversal (CVE-2026-50869) path traversal in path-traversal (CVE-2026-50869). Successful exploitation can lead to full system takeover.	Critical	PHP Path Traversal Cwe 22	3 weeks ago
CVE-2026-48114	SQL Injection in sqli (CVE-2026-48114) SQL injection in sqli (CVE-2026-48114). Successful exploitation can lead to full system takeover.	Critical	SQL Injection Cwe 89 Cwe 287	3 weeks ago
CVE-2026-39196	SQL Injection in sqli (CVE-2026-39196) SQL injection in sqli (CVE-2026-39196). Successful exploitation can lead to full system takeover.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-38329	Vulnerability in CVE-2026-38329 (CVE-2026-38329) vulnerability in CVE-2026-38329 (CVE-2026-38329). Successful exploitation can lead to full system takeover. Exploitable via `POST /api/files/{key}`.	Critical	PHP Remote Code Execution Cwe 862	3 weeks ago
CVE-2026-38812	SQL Injection in sqli (CVE-2026-38812) SQL injection in sqli (CVE-2026-38812). Successful exploitation can lead to full system takeover.	Critical	SQL Injection Cwe 89	3 weeks ago
CVE-2026-30120	Code Injection in remotion (CVE-2026-30120) code injection in remotion (CVE-2026-30120). Successful exploitation can lead to full system takeover. Mitigation: upgrade to `4.0.410` or later.	Critical	Remote Code Execution Cwe 94 Remotion	3 weeks ago
CVE-2026-36537	Vulnerability in CVE-2026-36537 (CVE-2026-36537) vulnerability in CVE-2026-36537 (CVE-2026-36537). Successful exploitation can lead to full system takeover.	Critical	Authentication Bypass Cwe 290	3 weeks ago
CVE-2018-25436	Unrestricted File Upload in wordpress (CVE-2018-25436) vulnerability in wordpress (CVE-2018-25436). Successful exploitation can lead to full system takeover.	Critical	PHP WordPress Remote Code Execution Cwe 434	3 weeks ago
CVE-2026-48558 KEV	[KEV] Vulnerability in Simplehelp simple-help (CVE-2026-48558) vulnerability in Simplehelp simple-help (CVE-2026-48558). Successful exploitation can lead to full system takeover. Listed in CISA KEV — actively exploited.	Critical	Authentication Bypass Cwe 347 Simple Help Simplehelp	3 weeks ago

Vulnerabilities

🍪 About cookies