01 Search console
The CVE corpus, on scope in milliseconds.
415,602 records · updated every 15 minutes
02 Telemetry
Total CVEs415,602
New today135
Known-exploited (KEV)1,760
Sync lag38 MIN
03 Severity mix
04 Latest published
CVE IDCVSSSeverityKEVSummaryVendor / ProductPublished
CVE-2026-632867.1High—Database backups are vulnerable to offline attacks. Backups created using a version prior to the patched version are still vulnerable. AXIS Camera Station Pro automatically creates one more suchaxis communications ab axis camera station 5 axis communications ab axis camera station pro44 MIN AGO
CVE-2026-1099756.4Medium—Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attributecozythemes cozy blocks – website builder & business growth toolkit | popups, lead forms & inbox53 MIN AGO
CVE-2026-760056.5Medium—WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attributechuck1982 wp inventory manager53 MIN AGO
CVE-2026-1181694.9Medium—Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameterwpmudev hustle – email marketing, lead generation, optins, popups53 MIN AGO
CVE-2026-1047434.9Medium—Tainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignmenttainacan tainacan53 MIN AGO
CVE-2026-767806.3Medium—BeyondSEO <= 1.3.6 - Missing Authorization to Authenticated (Contributor+) Limited Privilege Escalationrankingcoach beyondseo – ai seo to improve rankings, listings & online visibility53 MIN AGO
CVE-2026-1101855.9Medium—Bit Flows: AI Agent Automation & Integrations for Forms, CRM, eCommerce, Google Sheets, and More <= 1.31.0 - Unauthenticated Local File Inclusion via 'webhook' and 'body' Parametersbitpressadmin bit flows: ai agent automation & integrations for forms, crm, ecommerce, google sheets, and more53 MIN AGO
CVE-2026-1167506.5Medium—VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) SQL Injection via 'catid' Block Attributee4jvikwp vikrentcar car rental management system53 MIN AGO
CVE-2026-1092189.8Critical—Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypasskleor contact manager53 MIN AGO
CVE-2026-1093706.4Medium—Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attributebplugins document embedder – let visitors read files without downloading53 MIN AGO
CVE-2026-778716.4Medium—Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributessaadiqbal post snippets – custom wordpress code snippets customizer53 MIN AGO
CVE-2026-1077106.4Medium—Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Titlewpmudev hustle – email marketing, lead generation, optins, popups53 MIN AGO
CVE-2026-1099884.4Medium—Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameteracowebs product addons for woocommerce – product options with custom fields53 MIN AGO
CVE-2026-28395.3Medium—Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpointshwk-fr advanced custom fields: extended53 MIN AGO
CVE-2026-1167615.4Medium—CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Formjtsternberg cmb253 MIN AGO
05 Recently added to KEV
KEVCVE-2026-48356adobe adobe commerce adobe adobe commerce b2b adobe adobe commerce events adobe magento open sourceAdded 2026-10-27