Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (9584 CVEs found)

CVE Vendors Products Updated CVSS v3.1
CVE-2025-67580 2 Woocommerce, Wordpress 2 Woocommerce, Wordpress 2026-02-11 5.3 Medium
Missing Authorization vulnerability in Constant Contact Constant Contact + WooCommerce constant-contact-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact + WooCommerce: from n/a through <= 2.4.1.
CVE-2025-63008 2 Wedevs, Wordpress 2 Wp Erp, Wordpress 2026-02-11 5.3 Medium
Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through <= 1.16.7.
CVE-2025-63049 2 Cridio, Wordpress 2 Listingpro Lead Form, Wordpress 2026-02-11 5.3 Medium
Missing Authorization vulnerability in CridioStudio ListingPro Lead Form listingpro-lead-form allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ListingPro Lead Form: from n/a through <= 1.0.2.
CVE-2025-63054 2 Expresstech, Wordpress 2 Quiz And Survey Master, Wordpress 2026-02-11 5.3 Medium
Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through <= 10.3.1.
CVE-2025-63056 2 Bestwebsoft, Wordpress 2 Contact Form, Wordpress 2026-02-11 4.3 Medium
Missing Authorization vulnerability in bestwebsoft Contact Form by BestWebSoft contact-form-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by BestWebSoft: from n/a through <= 4.3.5.
CVE-2025-63063 1 Wordpress 1 Wordpress 2026-02-11 6.5 Medium
Missing Authorization vulnerability in Yandex Metrika Yandex.Metrica wp-yandex-metrika allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yandex.Metrica: from n/a through <= 1.2.2.
CVE-2024-4259 2 Sambas, Sampas Holding 2 Akos, Akos 2026-02-11 9.8 Critical
Missing Authorization vulnerability in SAMPAŞ Holding AKOS (AkosCepVatandasService), SAMPAŞ Holding AKOS (TahsilatService) allows Collect Data as Provided by Users. This issue affects AKOS (AkosCepVatandasService): before V2.0; AKOS (TahsilatService): before V1.0.7.
CVE-2024-21417 1 Microsoft 15 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 12 more 2026-02-10 8.8 High
Windows Text Services Framework Elevation of Privilege Vulnerability
CVE-2026-0845 2 Wclovers, Wordpress 2 Frontend Manager For Woocommerce Along With Bookings Subscription Listings Compatible, Wordpress 2026-02-10 7.2 High
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'WCFM_Settings_Controller::processing' function in all versions up to, and including, 6.7.24. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.
CVE-2026-0817 2 Mediawiki, Wikimedia 3 Mediawiki, Campaignevents, Mediawiki-campaignevents Extension 2026-02-10 5.3 Medium
Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.
CVE-2025-15342 1 Tanium 2 Reputation, Service Reputation 2026-02-10 4.3 Medium
Tanium addressed an improper access controls vulnerability in Reputation.
CVE-2025-15289 1 Tanium 2 Interact, Service Interact 2026-02-10 3.1 Low
Tanium addressed an improper access controls vulnerability in Interact.
CVE-2025-15330 1 Tanium 2 Deploy, Service Deploy 2026-02-10 8.8 High
Tanium addressed an improper input validation vulnerability in Deploy.
CVE-2025-15327 1 Tanium 2 Deploy, Service Deploy 2026-02-10 4.3 Medium
Tanium addressed an improper access controls vulnerability in Deploy.
CVE-2025-15326 1 Tanium 2 Patch, Service Patch 2026-02-10 4.3 Medium
Tanium addressed an improper access controls vulnerability in Patch.
CVE-2025-15321 1 Tanium 1 Tanos 2026-02-10 2.7 Low
Tanium addressed an improper input validation vulnerability in Tanium Appliance.
CVE-2026-1007 1 Devolutions 1 Devolutions Server 2026-02-10 7.6 High
Incorrect Authorization vulnerability in virtual gateway component in Devolutions Server allows attackers to bypass deny IP rules.This issue affects Server: from 2025.3.1 through 2025.3.12.
CVE-2025-63077 3 Elementor, Happymonster, Wordpress 3 Elementor, Happy Addons For Elementor, Wordpress 2026-02-10 4.3 Medium
Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through <= 3.20.2.
CVE-2025-14895 2 Roxnor, Wordpress 2 Popup Builder With Gamification, Multi-step Popups, Page-level Targeting, And Woocommerce Triggers, Wordpress 2026-02-10 5.4 Medium
The PopupKit plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.0. This is due to the plugin not properly verifying that a user is authorized to access the /popup/logs REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete analytics data including device types, browser information, countries, referrer URLs, and campaign metrics.
CVE-2026-1722 2 Wclovers, Wordpress 2 Wcfm Marketplace – Multivendor Marketplace For Woocommerce, Wordpress 2026-02-10 5.3 Medium
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0. This is due to the plugin not implementing authorization checks in the `wcfm-refund-requests-form` AJAX controller. This makes it possible for unauthenticated attackers to create arbitrary refund requests for any order ID and item ID, potentially leading to financial loss if automatic refund approval is enabled in the plugin settings.