Search

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Search Examples

CVEs in KEV CVEs with EPSS >= 80% Crit. Microsoft High Apache SQL Injection (CWE-89) Linux Kernel High (CVSS 3.1) Apache Struts RCE (Remote Code Execution) XSS (CWE-79) Critical (CVSS 4.0) CVEs to check

Search Results (637 CVEs found)

Export CSV
CVE Vendors Products Updated CVSS v3.1
CVE-2026-126331 1 Devolutions 1 Server 2026-11-13 N/A
Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response.
CVE-2026-125802 2026-11-13 5.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5.
CVE-2026-121771 2026-11-13 5.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Gutenberg Blocks: from n/a through 3.7.6.
CVE-2026-125777 2 Cozmoslabs, Wordpress-extensions 2 Profile Builder, Profile Builder 2026-11-13 5.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows Retrieve Embedded Sensitive Data.This issue affects Profile Builder: from n/a through 4.0.6.
CVE-2026-126308 1 Coder 1 Coder 2026-11-13 7.7 High
The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination.
CVE-2026-87801 1 Synology 1 Diskstation Manager 2026-11-13 6.5 Medium
An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read arbitrary files.
CVE-2026-121674 1 Microsoft 3 Powershell, Powershell 7.6, Powershell 7.7 2026-11-12 6.1 Medium
Insertion of sensitive information into sent data in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.
CVE-2026-123290 1 Jetbrains 1 Datalore 2026-11-12 5.3 Medium
In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint
CVE-2026-118083 2 Themeum, Wordpress-extensions 2 Wp Crowdfunding, Wp Crowdfunding 2026-11-12 7.5 High
Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.
CVE-2026-115947 2 Realmag777, Wordpress-extensions 2 Husky, Husky 2026-11-12 6.5 Medium
Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.
CVE-2026-116861 2 Wordpress-extensions, Wpdesk 2 Flexible Chat, Flexible Chat 2026-11-12 7.5 High
Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.
CVE-2026-114183 2 Wordpress-extensions, Wpvibes 2 Anywhere Elementor, Anywhere Elementor 2026-11-12 6.5 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0.
CVE-2026-119499 2 Bakkbone Australia, Wordpress-extensions 2 Floristpress, Floristpress 2026-11-12 7.5 High
Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Retrieve Embedded Sensitive Data.This issue affects FloristPress: from n/a through 7.8.4.
CVE-2026-63837 1 Linux 1 Linux Kernel 2026-11-12 5.5 Medium
In the Linux kernel, the following vulnerability has been resolved: net: ena: PHC: Check return code before setting timestamp output ena_phc_gettimex64() is setting the output parameter regardless of whether ena_com_phc_get_timestamp() succeeded or failed. When ena_com_phc_get_timestamp() returns an error, the timestamp parameter may contain uninitialized stack memory (e.g., when PHC is disabled or in blocked state) or invalid hardware values. Passing these to userspace via the PTP ioctl is both a security issue (information leak) and a correctness bug. Fix by checking the return code after releasing the lock and only setting the output timestamp on success.
CVE-2026-125435 2026-11-12 5.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3.
CVE-2026-119465 2 Wordpress-extensions, Wpvibes 2 Elementor Addon Elements, Elementor Addon Elements 2026-11-12 5.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Retrieve Embedded Sensitive Data.This issue affects Elementor Addon Elements: from n/a through 1.15.
CVE-2026-125766 2026-11-12 5.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allows Retrieve Embedded Sensitive Data.This issue affects WPZOOM Social Feed Widget & Block: from n/a through 2.4.1.
CVE-2026-125767 2026-11-12 5.3 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through 1.36.3.1.
CVE-2026-86505 1 Jetbrains 1 Intellij Idea 2026-11-12 3.3 Low
In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace
CVE-2025-47541 2026-11-12 7.5 High
Insertion of Sensitive Information Into Sent Data vulnerability in WPFunnels Team Mail Mint mail-mint allows Retrieve Embedded Sensitive Data.This issue affects Mail Mint: from n/a through 1.17.7.