Export limit exceeded: 425857 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425857 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 12015 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,015

Export CSV
CVE-2026-65551

WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Soflyy Wordpress
Products
Breakdance Wordpress
CVE-2026-97352

News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer

The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-114705

WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-114192

WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through 5.7.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-114191

WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through 1.6.3.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-72798

SiYuan before v3.7.4 Information Disclosure via renderAttributeView

SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published databases that relate to restricted databases to retrieve sensitive content, or bypass row filtering entirely when the first column is a non-block type.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-72797

SiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus

SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted notebooks and their current unlock status, revealing sensitive notebook names and decryption state in memory.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-72805

SiYuan before v3.7.4 Information Disclosure via Block Endpoints

SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader accounts can retrieve document titles, ancestor block content snippets, reference text, and path metadata for publish-forbidden or password-protected documents by supplying block IDs.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
B3log Siyuan
Products
Siyuan Siyuan
CVE-2026-16799

Unauthorized Reader Role Access to Automation Tests and Workflow Modification in Devolutions PowerShell Universal

Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization checks.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Devolutions
Products
Powershell Universal
CVE-2026-65525

WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Uxper Wordpress
Products
Civi Framework Wordpress
CVE-2026-111092

Cross-Project Command Execution via Mail Rules in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Youtrack
CVE-2026-91504

Remote Access Vulnerability Allowing Full Takeover of Oracle WebCenter Content

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Portal Suite). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Oracle Oracle Corporation
Products
Webcenter Content Oracle Webcenter Content
CVE-2026-107431

WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress-extensions
Products
Jetformbuilder Jetformbuilder
CVE-2026-107433

WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Miniorange Wordpress-extensions
Products
Wp Oauth Server Wp Oauth Server
CVE-2026-110371

WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpchill
Products
Strong Testimonials Strong Testimonials