01 Search console
The CVE corpus, on scope in milliseconds.
416,288 records · updated every 15 minutes
02 Telemetry
Total CVEs416,288
New today24
Known-exploited (KEV)1,762
Sync lag29 MIN
03 Severity mix
04 Latest published
CVE IDCVSSSeverityKEVSummaryVendor / ProductPublished
CVE-2026-937577.5High—Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisitewild-apricot wild apricot login51 MIN AGO
CVE-2026-962288.1High—SSL Wireless SMS Notification <= 3.8.1 - Unauthenticated Authentication Bypass to Account Takeoversslplugins ssl wireless sms notification51 MIN AGO
CVE-2026-966667.2High—Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filtervberkel schema app structured data51 MIN AGO
CVE-2026-939047.5High—Social Web Suite <= 4.1.12 - Unauthenticated SQL Injection via 'exclude_posts' Parameterdejanmarkovic social web suite – social media auto post, social media auto publish51 MIN AGO
CVE-2026-938557.5High—SendPress Newsletters <= 1.26.1.20 - Unauthenticated SQL Injection via 'subscriberid' Parameterbrewlabs sendpress newsletters51 MIN AGO
CVE-2026-966697.2High—Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookiewpscripts food store – online food delivery & pickup51 MIN AGO
CVE-2026-967417.2High—DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruptionmlfactory dsgvo all in one for wp51 MIN AGO
CVE-2026-1095169.8Critical—Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Forced Login Tokenguruteam bot for telegram on woocommerce51 MIN AGO
CVE-2026-429495.6Medium—A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to execute priviledged operation. Anfrangoteam frangoteam1 HR AGO
CVE-2026-400635.3Medium—A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to an information leak. An attackerfrangoteam frangoteam1 HR AGO
CVE-2026-429229.8Critical—A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker canfrangoteam frangoteam1 HR AGO
CVE-2026-1184265.3Medium—In affected versions of Octopus Server with the LDAP authentication provider enabled, any authenticated user could call the LDAP user search and LDAP group search.octopus deploy octopus server2 HR AGO
CVE-2026-1134094.8Medium—The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configurationcanva ortto2 HR AGO
CVE-2026-1141735.3Medium—The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthenticated threat actor could read product passwords andcanva ortto2 HR AGO
CVE-2026-1133878.6High—The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public HTML. An unauthenticated threat actor could overwrite thecanva ortto2 HR AGO
05 Recently added to KEV
KEVCVE-2026-41709vmware cloud foundation vmware esx vmware telco cloud platform vmware vsphere foundationAdded 2026-10-28
KEVCVE-2026-48356adobe adobe commerce adobe adobe commerce b2b adobe adobe commerce events adobe magento open sourceAdded 2026-10-27