Search

Expected end of text, found '/' (at char 25), (line:1, col:26)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (354847 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2026-47884 1 Spring 1 Spring Framework 2026-08-27 9.8 Critical
Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
CVE-2026-47886 1 Spring 1 Spring Framework 2026-08-27 7.5 High
Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier
CVE-2026-47889 1 Spring 1 Spring Framework 2026-08-27 7.5 High
A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19
CVE-2026-16567 2026-08-27 5.3 Medium
The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs.
CVE-2026-19223 2026-08-27 7.2 High
The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
CVE-2026-19225 2026-08-27 6.6 Medium
The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
CVE-2026-19715 2026-08-27 7.5 High
The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user records including password hashes when debug logging is enabled.
CVE-2021-48005 2026-08-27 N/A
This CVE ID has been rejected.
CVE-2021-48004 2026-08-27 N/A
This CVE ID has been rejected.
CVE-2021-48003 2026-08-27 N/A
This CVE ID has been rejected.
CVE-2021-48002 2026-08-27 N/A
This CVE ID has been rejected.
CVE-2021-48001 2026-08-27 N/A
This CVE ID has been rejected.
CVE-2021-48000 2026-08-27 N/A
This CVE ID has been rejected.
CVE-2021-47999 2026-08-27 N/A
This CVE ID has been rejected.
CVE-2021-47998 2026-08-27 N/A
This CVE ID has been rejected.
CVE-2021-47997 2026-08-27 N/A
This CVE ID has been rejected.
CVE-2022-51007 2026-08-27 N/A
This CVE ID has been rejected.
CVE-2022-51006 2026-08-27 N/A
This CVE ID has been rejected.
CVE-2022-51005 2026-08-27 N/A
This CVE ID has been rejected.
CVE-2022-51004 2026-08-27 N/A
This CVE ID has been rejected.