Vulnerabilities

Aggregated CVE / GHSA / KEV / OSV — filter by tag and category.

KEV

Categories

All 🌐 Web Application 🧭 Browser 🖥️ Operating System 📱 Mobile 🛰️ Network Infrastructure ☁️ Cloud / Container 📝 CMS / Site Builder 🗄️ Database / Storage 🔐 Auth / Identity 🔑 Cryptography 🛠️ DevOps / CI-CD 🤖 AI / ML 🔌 IoT / Embedded 🧩 Hardware / Firmware 🏢 Enterprise SaaS 🧰 Developer Tooling ☠️ Malicious Package 📦 Other

Tag groups

All 💬 Programming Languages 22 🧱 Web Frameworks 29 📱 Mobile Platforms 6 🤖 AI/ML Frameworks 11 🖥️ Web Servers 9 🗄️ Databases 13 📝 CMS 9 ☁️ Cloud Platforms 11 📦 Container Tech 12 🖥️ Operating Systems 15 ⚔️ Attack Types 25 🧬 CWE 185 🏢 Vendors 581 📦 Products 666 🌳 Package Ecosystems 24 🛠️ DevOps Tools 17 📡 Protocols 15

Popular tags (Top 40)

Rootio Linux419 Microsoft386 C237 Java183 Jre178 Java Min178 Bitnami178 Windows177 Rootdebian11175 Rootdebian12151 Linux130 Cwe 20125 Cwe 78120 Linux Kernel106 Cwe 787105 Apple99 Cwe 41699 Cwe 2296 Rootdebian1393 Cwe 11990 Cisco89 Denial of Service85 Cwe 9484 Multiple Products79 Adobe78 Google77 Cwe 50270 Cwe 7966 Cwe 8954 Apache47 Cwe 91844 Cwe 28443 Oracle42 Cwe 28741 JavaScript41 PHP41 Cwe 7740 Chromium V838 Cwe 30638 Cwe 84337

ID	Title	Severity	Tags	Detected
CVE-2026-45441	Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions. Unauthenticated Other Vulnerability Type in WpEvently <= 5.3.3 versions.	High	Cwe 1284	2 months ago
CVE-2026-45437	Cross-Site Scripting (XSS) in CVE-2026-45437 (CVE-2026-45437) cross-site scripting in CVE-2026-45437 (CVE-2026-45437). Risk of unauthorized operations or information disclosure.	High	Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-47825	Vulnerability in CVE-2026-47825 (CVE-2026-47825) vulnerability in CVE-2026-47825 (CVE-2026-47825). Data can be tampered with by attackers.	High	Cwe 346	2 months ago
CVE-2026-40766	Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions. Subscriber SQL Injection in MasterStudy LMS <= 3.7.25 versions.	High	SQL Injection Cwe 89	2 months ago
CVE-2026-40776	Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions. Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.	High	Cwe 862	2 months ago
CVE-2026-40770	Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions. Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions.	High	Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-40781	Unauthenticated Broken Authentication in ReviewX <= 2.3.6 versions. Unauthenticated Broken Authentication in ReviewX <= 2.3.6 versions.	High	Cwe 288	2 months ago
CVE-2026-40769	Path Traversal in CVE-2026-40769 (CVE-2026-40769) path traversal in CVE-2026-40769 (CVE-2026-40769). Risk of unauthorized operations or information disclosure.	High	Cwe 22	2 months ago
CVE-2026-40767	Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions. Unauthenticated Broken Access Control in wpForo Forum < 3.0.2 versions.	High	Cwe 281	2 months ago
CVE-2026-40785	Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions. Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions.	High	Cwe 288	2 months ago
CVE-2026-40787	Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions. Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.	High	Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-40774	Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions. Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.	High	Cwe 862	2 months ago
CVE-2026-40775	Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions. Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions.	High	Cwe 862	2 months ago
CVE-2026-40788	Subscriber Broken Access Control in ChatBot <= 7.9.7 versions. Subscriber Broken Access Control in ChatBot <= 7.9.7 versions.	High	Cwe 862	2 months ago
CVE-2026-40789	Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions. Unauthenticated Sensitive Data Exposure in Amelia <= 2.2 versions.	High	Cwe 201	2 months ago
CVE-2026-40779	Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions. Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions.	High	Cwe 22	2 months ago
CVE-2026-40791	Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions. Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions.	High	Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-42384	Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11.2 versions. Unauthenticated Sensitive Data Exposure in Simply Schedule Appointments < 1.6.11.2 versions.	High	Cwe 201	2 months ago
CVE-2026-39587	Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions. Unauthenticated Privilege Escalation in WP BASE Booking <= 5.9.0 versions.	High	Privilege Escalation Cwe 266	2 months ago
CVE-2026-39534	Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions. Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.	High	Cwe 862	2 months ago
CVE-2026-39532	Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions. Contributor PHP Object Injection in Events Calendar for GeoDirectory <= 2.3.25 versions.	High	PHP Cwe 502	2 months ago
CVE-2026-40732	Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions. Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.	High	Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-39579	Contributor Privilege Escalation in B Blocks <= 2.0.31 versions. Contributor Privilege Escalation in B Blocks <= 2.0.31 versions.	High	Privilege Escalation Cwe 266	2 months ago
CVE-2026-40741	Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 versions. Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 versions.	High	Cwe 862	2 months ago
CVE-2026-40727	Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions. Sales Representative Arbitrary File Deletion in Groundhogg <= 4.4 versions.	High	Cwe 22	2 months ago
CVE-2026-40762	Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions. Unauthenticated SQL Injection in WPGraphQL < 2.11.1 versions.	High	SQL Injection Cwe 89	2 months ago
CVE-2026-39533	Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions. Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions.	High	Cwe 862	2 months ago
CVE-2026-39463	Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions. Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.	High	Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-39447	Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions. Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions.	High	Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-39470	Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions. Shop manager Privilege Escalation in WooCommerce Cart Abandonment Recovery < 2.1.0 versions.	High	Privilege Escalation Cwe 266	2 months ago
CVE-2026-39450	Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions. Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.	High	Cwe 288	2 months ago
CVE-2026-39449	Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions. Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions.	High	Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-39471	Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions. Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.	High	PHP Cwe 502	2 months ago
CVE-2026-39480	Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions. Unauthenticated Sensitive Data Exposure in Backup Migration <= 2.1.1 versions.	High	Cwe 201	2 months ago
CVE-2026-39474	Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions. Contributor PHP Object Injection in Post Duplicator <= 3.0.10 versions.	High	PHP Cwe 502	2 months ago
CVE-2026-39472	Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions. Shop manager PHP Object Injection in WooCommerce PDF Invoices & Packing Slips < 5.9.0 versions.	High	PHP Cwe 502	2 months ago
CVE-2026-39478	Unsafe Deserialization in CVE-2026-39478 (CVE-2026-39478) vulnerability in CVE-2026-39478 (CVE-2026-39478). Successful exploitation can lead to full system takeover.	High	PHP Cwe 502	2 months ago
CVE-2026-39481	Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions. Author PHP Object Injection in Modula Image Gallery <= 2.14.18 versions.	High	PHP Cwe 502	2 months ago
CVE-2026-39499	Unsafe Deserialization in CVE-2026-39499 (CVE-2026-39499) vulnerability in CVE-2026-39499 (CVE-2026-39499). Successful exploitation can lead to full system takeover.	High	PHP Cwe 502	2 months ago
CVE-2026-39503	Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions. Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.	High	Cwe 862	2 months ago
CVE-2026-39507	Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions. Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.	High	Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-39518	Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions. Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.	High	Cwe 639	2 months ago
CVE-2026-39513	Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions. Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.	High	Cwe 862	2 months ago
CVE-2026-39498	Shop manager PHP Object Injection in YayMail <= 4.3.3 versions. Shop manager PHP Object Injection in YayMail <= 4.3.3 versions.	High	PHP Cwe 502	2 months ago
CVE-2026-39524	Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions. Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.	High	Cwe 862	2 months ago
CVE-2026-39514	Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions. Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.	High	Cross-Site Scripting Cwe 79	2 months ago
CVE-2025-68872	Cross-Site Scripting (XSS) in CVE-2025-68872 (CVE-2025-68872) cross-site scripting in CVE-2025-68872 (CVE-2025-68872). Risk of unauthorized operations or information disclosure.	High	Cross-Site Scripting Cwe 79	2 months ago
CVE-2025-68840	Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions. Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.	High	Cross-Site Scripting Cwe 79	2 months ago
CVE-2026-27089	Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions. Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions.	High	Cwe 290	2 months ago
CVE-2026-34898	Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions. Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions.	High	Cwe 862	2 months ago

Vulnerabilities

🍪 About cookies