CVE Vulnerability Database
Search and browse 376,700 CVE records with CVSS scores, EPSS exploit predictions, and CISA KEV status.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-12501 | MEDIUM | 5.3 | 0.2% | Aug 6, 2026 | The WP Travel Engine WordPress plugin before 6.8.2 does not verify that an incoming PayPal payment notification was sent... |
| CVE-2026-11976 | CRITICAL | 10 | 0.5% | Aug 6, 2026 | The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both ... |
| CVE-2026-11803 | HIGH | 7.8 | 0.1% | Aug 6, 2026 | A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A mal... |
| CVE-2026-11361 | MEDIUM | 5.9 | 0.1% | Aug 6, 2026 | The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payme... |
| CVE-2026-10599 | HIGH | 7.5 | 0.2% | Aug 6, 2026 | The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transact... |
| CVE-2026-10524 | HIGH | 7.5 | 0.3% | Aug 6, 2026 | The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price ... |
| CVE-2025-6508 | MEDIUM | 4.3 | 0.2% | Aug 6, 2026 | The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to b... |
| CVE-2025-15674 | LOW | 2.7 | 0.2% | Aug 6, 2026 | The Passster WordPress plugin before 4.3.7 does not restrict low-privilege users holding the edit_posts capability from ... |
| CVE-2025-14561 | CRITICAL | 9 | 0.4% | Aug 6, 2026 | In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in o... |
| CVE-2025-12317 | MEDIUM | 5 | 0.2% | Aug 6, 2026 | When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issue... |
| CVE-2024-6541 | MEDIUM | 6.8 | 0.3% | Aug 6, 2026 | The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dy... |
| CVE-2024-39024 | HIGH | 8.8 | 0.4% | Aug 6, 2026 | In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution. |
| CVE-2026-16633 | HIGH | 8.6 | — | Aug 6, 2026 | ### Impact If PDF.js is used to load a malicious PDF, and PDF.js is configured with `enableScripting` set to true (whic... |
| CVE-2026-68750 | HIGH | 7.5 | 0.4% | Aug 6, 2026 | Inefficient Algorithmic Complexity vulnerability in the traversal engine in rrrene html_sanitize_ex allows an unauthenti... |
| CVE-2026-68749 | HIGH | 7.5 | 0.4% | Aug 6, 2026 | Inefficient Regular Expression Complexity vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthe... |
| CVE-2026-68747 | MEDIUM | 6.1 | 0.4% | Aug 6, 2026 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the ... |
| CVE-2026-66843 | MEDIUM | 6.1 | 0.5% | Aug 6, 2026 | Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex ... |
| CVE-2026-66829 | MEDIUM | 6.1 | 0.8% | Aug 6, 2026 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allow... |
| CVE-2026-66370 | MEDIUM | 6.1 | 0.4% | Aug 6, 2026 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allow... |
| CVE-2026-5423 | HIGH | 8.2 | — | Aug 6, 2026 | @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT obj... |
| CVE-2026-53985 | HIGH | 8.7 | — | Aug 6, 2026 | Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's serv... |
| CVE-2026-53977 | HIGH | 8.7 | — | Aug 6, 2026 | OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to termi... |
| CVE-2026-43622 | HIGH | 8.5 | 0.1% | Aug 6, 2026 | llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper where new_1bat... |
| CVE-2026-3430 | HIGH | 8.6 | — | Aug 6, 2026 | The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL s... |
| CVE-2026-19047 | MEDIUM | 5.3 | 0.7% | Aug 6, 2026 | A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/e... |