Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (1121 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-114537 1 Drupal 1 View Unpublished 2026-11-06 5.3 Medium
Incorrect Authorization vulnerability in Drupal View Unpublished allows Forceful Browsing. This issue affects View Unpublished versions: from 0.0.0 to 1.5.0.
CVE-2026-107773 2026-11-06 6.5 Medium
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders.
CVE-2026-107775 2026-11-06 2.7 Low
The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that the acting administrator is authorized to manage each selected user before enabling that user's marketplace seller status, allowing a subsite Administrator on WordPress Multisite to enable selling for users outside their own site, including network-level users they cannot otherwise manage.
CVE-2026-112340 1 Wazuh 1 Wazuh 2026-11-06 8.2 High
Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization values that replace the server-side session Bearer token, letting them act as another Manager API identity or send unauthenticated upstream requests.
CVE-2026-118569 1 Drupal 1 Fasttoggle 2026-11-06 5.4 Medium
Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1.
CVE-2026-118557 1 Drupal 1 Commerce Shipping 2026-11-06 2.7 Low
Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
CVE-2026-118556 1 Drupal 1 Commerce Shipping 2026-11-06 6.5 Medium
Incorrect Authorization vulnerability in Drupal Commerce Shipping allows Forceful Browsing. This issue affects Commerce Shipping versions: from 0.0.0 to 2.16.0, from 3.0.0 to 3.0.6.
CVE-2026-118555 1 Drupal 1 Commerce License 2026-11-06 6.3 Medium
Incorrect Authorization vulnerability in Drupal Commerce License allows Forceful Browsing. This issue affects Commerce License versions: from 0.0.0 to 3.1.1.
CVE-2026-114554 1 Drupal 1 Ai File To Text 2026-11-06 4.3 Medium
Incorrect Authorization vulnerability in Drupal AI File to Text allows Forceful Browsing. This issue affects AI File to Text versions: from 0.0.0 to 1.0.1.
CVE-2026-118167 2026-11-06 5.3 Medium
The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration subscribes a visitor to matches the audience configured by the site owner, allowing unauthenticated visitors to subscribe arbitrary email addresses to any other audience in the site's connected Mailchimp account.
CVE-2026-123334 1 Jetbrains 1 Youtrack 2026-11-06 3.8 Low
In JetBrains YouTrack before 2026.2.19562 project admins of a related project could delete VCS integrations owned by another project
CVE-2026-123296 1 Jetbrains 1 Hub 2026-11-06 7.5 High
In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible
CVE-2026-118584 1 Drupal 1 Field Permissions 2026-11-06 5.3 Medium
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
CVE-2026-118583 1 Drupal 1 Field Permissions 2026-11-06 5.3 Medium
Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0.
CVE-2026-118567 1 Drupal 1 Bulk Update User Roles 2026-11-06 4.7 Medium
Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5.
CVE-2026-118548 1 Drupal 1 Artificial Intelligence 2026-11-06 3.7 Low
Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2.
CVE-2026-118542 1 Drupal 1 Commerce Core 2026-11-06 2.7 Low
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118541 1 Drupal 1 Commerce Core 2026-11-06 4.3 Medium
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13.
CVE-2026-118540 1 Drupal 1 Commerce Core 2026-11-06 5.3 Medium
Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0.
CVE-2026-114571 1 Drupal 1 Rabbit Hole 2026-11-06 6.5 Medium
Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0.