Export limit exceeded: 390737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 390737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 390737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Expected end of text, found ':' (at char 6), (line:1, col:7)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (390737 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-23591 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23590 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23589 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23588 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23587 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23586 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23585 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23584 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-23583 2026-09-02 N/A
Withdrawn by requester.
CVE-2026-75411 1 Jeecgboot 1 Jeecgboot 2026-09-02 9.8 Critical
JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection.
CVE-2026-26897 2026-09-02 9.8 Critical
An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component
CVE-2026-30073 1 Free5gc 1 Free5gc 2026-09-02 7.5 High
An issue in the NssaiAvailabilitySubscriptionCreate component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
CVE-2026-30612 2026-09-02 9.8 Critical
An issue in Time4 Popcorn for Windows <= 6.2.1.18 and Time4Popcorn for MacOS <= 6.2.1.17 and Time4Popcorn for Android <= 3.5.0.173 allows a remote attacker to execute arbitrary code via the updater.exe for windows, PT.updd on MacOS components
CVE-2026-51614 1 Totolink 1 T6 2026-09-02 4.3 Medium
Incorrect access control in the getAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain access-device policy and client state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51615 1 Totolink 1 T6 2026-09-02 7.5 High
Incorrect access control in the getLanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51638 1 Totolink 1 T6 2026-09-02 4.3 Medium
Incorrect access control in the getWiFiGuestCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain guest Wi-Fi configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-51654 1 Totolink 1 T6 2026-09-02 4.3 Medium
Incorrect access control in the getScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain schedule or scheduled-reboot configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi.
CVE-2026-4378 1 Akilli Commerce Software Technologies Ltd. Co. 1 E-commerce Pack 2026-09-02 5.4 Medium
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 before 4.6.001.
CVE-2026-19912 2026-09-02 9.8 Critical
The Kaltura HTML5 player (mwEmbed / html5lib) contains an unauthenticated remote code execution vulnerability caused by unsafe data deserialization and unsanitized filesystem path construction. mwEmbedLoader.php accepts a user‑controlled ServiceUrl, whose response is passed to unserialize(), and the resulting object’s fields are written to a cache path derived from attacker‑supplied uiconf_id without proper path validation. An attacker can write arbitrary files into web‑accessible locations and achieve code execution as the webserver user. Affected versions include html5lib v2.45, v2.103 and earlier, and other v2.x releases exposing the vulnerable endpoint.
CVE-2025-70340 1 Thingsboard 1 Thingsboard 2026-09-02 6.5 Medium
A Broken Access Control vulnerability exists in ThingsBoard Professional Edition (PE) 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows unauthorized impersonation of system messages and modification of trusted system-owned data, resulting in vertical privilege escalation and potential integrity violations.