Export limit exceeded: 92923 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (92923 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-95706 2026-10-23 7.2 High
No description provided
CVE-2026-79882 2026-10-23 8.3 High
No description provided
CVE-2026-79890 2026-10-23 8.1 High
No description provided
CVE-2026-95707 2026-10-23 7.2 High
No description provided
CVE-2026-95708 2026-10-23 7.2 High
No description provided
CVE-2026-79846 2026-10-23 10 Critical
No description provided
CVE-2026-115398 2 Nationalsecurityagency, Nsa 2 Ghidra, Ghidra 2026-10-23 5.5 Medium
Ghidra before 12.2 contains a resource allocation without limits vulnerability in FileSystemIndexHelper used by TarFileSystem and ZipFileSystem, which store unbounded archive entries. Attackers can persuade a user to open or batch-import a crafted TAR or ZIP archive with excessive entries to exhaust the Java heap and hang the session.
CVE-2026-115504 1 Heasarc 1 Cfitsio 2026-10-23 7.8 High
CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts attacker-controlled heap descriptor lengths for variable-length string columns. Attackers can supply a crafted FITS file that overflows a fixed 28,800-byte stack buffer and the caller's string array, enabling arbitrary code execution.
CVE-2026-109198 2026-10-23 7.2 High
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires user registration to be open on the site, and script execution is triggered when an Administrator subsequently runs the plugin's user-spam scan and views the resulting Non-checkable users or Spam users tab — the plugin's own documented workflow.
CVE-2026-79956 2026-10-23 7.2 High
No description provided
CVE-2026-95705 2026-10-23 7.2 High
No description provided
CVE-2026-95709 2026-10-23 7.2 High
No description provided
CVE-2026-95712 2026-10-23 7.1 High
No description provided
CVE-2026-95717 2026-10-23 5.5 Medium
No description provided
CVE-2026-95719 2026-10-23 4.9 Medium
No description provided
CVE-2026-79861 2026-10-23 9.8 Critical
No description provided
CVE-2026-79864 2026-10-23 9.6 Critical
No description provided
CVE-2026-79878 2026-10-23 8.8 High
No description provided
CVE-2026-79879 2026-10-23 8.8 High
No description provided
CVE-2026-79892 2026-10-23 7.8 High
No description provided