01 Search console
The CVE corpus, on scope in milliseconds.
395,515 records · updated every 15 minutes
02 Telemetry
Total CVEs395,515
New today66
Known-exploited (KEV)1,716
Sync lag25 MIN
03 Severity mix
04 Latest published
CVE IDCVSSSeverityKEVSummaryVendor / ProductPublished
CVE-2026-150986.4Medium—Real 3D Flipbook <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attributecreativeinteractivemedia real3d flipbook – 3d flipbook, pdf flipbook, pdf viewer, pdf embedder30 MIN AGO
CVE-2026-879176.1Medium—MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tagdvankooten mc4wp: mailchimp for wordpress30 MIN AGO
CVE-2026-19845.3Medium—Ibtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Actionvowelweb ibtana – ecommerce product addons31 MIN AGO
CVE-2026-98556.5Medium—Custom Field Template <= 2.7.8 - Authenticated (Contributor+) SQL Injection via 'post_ID' Parameterhiroaki-miyashita custom field template31 MIN AGO
CVE-2026-54006.4Medium—Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Inputdavidanderson redux framework31 MIN AGO
CVE-2026-75274.7Medium—WP Ghost (Hide My WP Ghost) <= 7.0.02 - Unauthenticated Open Redirect via 'redirect_to' Parameterjohndarrel hide my wp ghost – security & firewall31 MIN AGO
CVE-2026-856588.1High—Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'eup_bio' Biography Field (Entity-Encoded Shortcode Bracket)properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress31 MIN AGO
CVE-2026-124024.4Medium—OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Settingxootix otp login & register woocommerce31 MIN AGO
CVE-2026-759594.9Medium—GoPay for WooCommerce <= 1.0.36 - Authenticated (Shop Manager+) SQL Injection via 'log_table_filter' Parametergopayplugins gopay for woocommerce31 MIN AGO
CVE-2026-132006.5Medium—Create <= 2.5.3 - Authenticated (Author+) SQL Injection via 'order' Parametermischiefmarmot create31 MIN AGO
CVE-2026-16416.5Medium—Wow Elements Addons for Elementor <= 1.11.2 - Authenticated (Contributor+) Server-Side Request Forgery via Changelog File Settingwowelements wow elements addons for elementor31 MIN AGO
CVE-2026-24226.4Medium—WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcodeghozylab wp composer – the easiest page builder31 MIN AGO
CVE-2026-43278.8High—The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parametersebwordpress the welcomizer31 MIN AGO
CVE-2026-92326.5Medium—Easy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Actioneasyappointments easy appointments31 MIN AGO
CVE-2026-154636.1Medium—SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameterssslzen ssl zen — ssl certificate installer & https redirects31 MIN AGO
05 Recently added to KEV
KEVCVE-2026-87886acronis acronis backup extension for plesk acronis acronis backup plugin for cpanel & whm acronis acronis backup plugin for directadminAdded 2026-09-16
KEVCVE-2026-76460cisco cisco identity services engine software cisco cisco ise passive identity connectorAdded 2026-09-16