Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (3539 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-62090 2026-10-11 9.8 Critical
Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.
CVE-2026-62087 2026-10-11 9.8 Critical
Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.
CVE-2026-62086 2026-10-11 9.8 Critical
Unauthenticated PHP Object Injection in Juno <= 2.25 versions.
CVE-2026-62077 2026-10-11 9.8 Critical
Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.
CVE-2026-62076 2026-10-11 9.8 Critical
Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.
CVE-2026-62054 2026-10-11 9.8 Critical
Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.
CVE-2026-62053 2026-10-11 9.8 Critical
Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.
CVE-2026-62052 2026-10-11 9.8 Critical
Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.
CVE-2026-62051 2026-10-11 9.8 Critical
Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.
CVE-2026-62050 2026-10-11 9.8 Critical
Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.
CVE-2026-42723 2026-10-11 9.8 Critical
Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.
CVE-2026-42718 2026-10-11 9.8 Critical
Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.
CVE-2026-42716 2026-10-11 9.8 Critical
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
CVE-2026-78401 1 Ibm 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more 2026-10-10 9.8 Critical
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
CVE-2026-94568 2026-10-09 7.2 High
Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue affects Pay with Vipps for WooCommerce: from n/a through 6.2.0.
CVE-2026-104392 2026-10-09 8.8 High
Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7.
CVE-2026-102554 1 Google 1 Guava 2026-10-09 7.5 High
Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.1 allows an attacker to cause a Denial of Service via OutOfMemoryError. When deserializing CompactHashMap, CompactHashSet, or MapMakerInternalMap instances, Guava eagerly allocates an array based on a caller-specified size parameter without throttling, permitting memory exhaustion from crafted serialization streams.
CVE-2026-105436 2 Mainwp, Wordpress-extensions 2 Mainwp Child, Mainwp Child 2026-10-09 8.8 High
Deserialization of Untrusted Data vulnerability in MainWP MainWP Child mainwp-child allows Object Injection.This issue affects MainWP Child: from n/a through 6.2.1.
CVE-2026-78406 1 Ibm 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more 2026-10-09 9.8 Critical
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.
CVE-2026-97188 1 Wordpress-extensions 1 String Locator 2026-10-09 8.8 High
The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed String locator WordPress plugin before 2.6.8 or , this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.