Export limit exceeded: 425902 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425902 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 425902 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Expected end of text, found ':' (at char 26), (line:1, col:27)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,902

Export CSV
CVE-2026-123707

WPGraphQL < 2.27.1 - Contributor+ Custom Post Status Content Disclosure

The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses.

CVSS n/a EPSS n/a KEV · Not listed
Vendors
Wordpress-extensions
Products
Wpgraphql
CVE-2026-129443

itsourcecode Airline Reservation System manage_user.php sql injection

A vulnerability was determined in itsourcecode Airline Reservation System 1.0. The impacted element is an unknown function of the file /admin/manage_user.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
Itsourcecode
Products
Airline Reservation System
CVE-2026-116559

A2Reviews <= 1.2.3 - Unauthenticated Plugin Data Modification and Disclosure

The A2Reviews WordPress plugin through 1.2.3 does not properly verify authorization on several of its API command handlers, relying on a signature keyed on a value that is empty by default on an unconnected install, allowing unauthenticated attackers to modify A2Reviews WordPress plugin through 1.2.3 settings and product review metadata and to read non-public product metadata.

CVSS n/a EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-110960

Auth Armor <= 1.0.3 - Unauthenticated Account Takeover

The Auth Armor WordPress plugin through 1.0.3 does not require authentication on several handlers available to logged-out users, which leak the site's stored API credentials and allow an unauthenticated attacker to reset an administrator's enrollment and take over that administrator account.

CVSS n/a EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-110987

RegistrationMagic < 6.1.0.4 - Reflected XSS via 'rm_tr' and 'rm_ur' Parameters

The RegistrationMagic WordPress plugin before 6.1.0.4 does not properly escape a user-supplied value before printing it inside an inline script block on several of its admin screens, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in the session of an administrator who is tricked into opening a crafted link.

CVSS n/a EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-114451

Kadence Memberships < 4.0.6 - Unauthenticated Table Collation Downgrade via 'rcp-action' Parameter

The Membership Plugin WordPress plugin before 4.0.6 does not perform any authorization or CSRF check before running a schema-altering database maintenance routine, allowing unauthenticated users to convert the Membership Plugin WordPress plugin before 4.0.6's own tables to a narrower character set, which irreversibly replaces every 4-byte character (such as emoji and some CJK characters) in the membership level, discount code and payment records with a question mark.

CVSS n/a EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-124671

Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure Beyond Shared Report Date Range

The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather than the period the report was shared for.

CVSS n/a EPSS n/a KEV · Not listed
Vendors
Wordpress-extensions
Products
Burst Statistics
CVE-2026-124673

Burst Statistics < 3.7.5 - Unauthenticated Draft and Private Post Title Disclosure via Forged Page View

The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclose the titles and permalinks of draft, pending and private posts.

CVSS n/a EPSS n/a KEV · Not listed
Vendors
Wordpress-extensions
Products
Burst Statistics
CVE-2026-127048

Lazy Blocks < 3.0.0 - Unauthenticated RCE

The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary PHP code on the server.

CVSS n/a EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-13409

Denial of Service via VAPIX Dynamicoverlay CGI in Axis OS

The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Axis Communications Ab
Products
Axis Os
CVE-2026-14542

Privilege Escalation in Axis OS VAPIX SIP Configuration API

The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalation. This flaw can only be exploited after authenticating with an admin-privileged service account.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed
Vendors
Axis Communications Ab
Products
Axis Os
CVE-2026-63288

Authentication Bypass via WebSocket Endpoint in Axis Secure Entry Cameras

A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-12389

Remote Code Execution via Deserialization Vulnerability in Axis Camera Station Pro

A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Axis Communications Ab
Products
Axis Camera Station Pro
CVE-2026-112137

Cross‑Site Request Forgery Vulnerability in Mendix Studio Pro 11

A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery (CSRF). This could allow a malicious web page to trick a user's browser into sending unauthorized requests and executing unintended actions on the local MCP Server.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-110984

RegistrationMagic < 6.1.0.4 - Admin+ SQLi via 'rm_fromdate' and 'rm_dateupto' Parameters

The RegistrationMagic WordPress plugin before 6.1.0.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks.

CVSS n/a EPSS n/a KEV · Not listed
Vendors
—
Products
—