CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

4332 matches found

Positive Technologies•added 2026/05/12 12:00 a.m.•32 views

PT-2026-40245

Horilla is an HR and CRM software. In 1.5.0, the notification endpoints trust the unvalidated next parameter and redirect users to arbitrary external URLs. This allows an attacker to turn trusted application links into phishing or social-engineering redirects...

4.8CVSS5.9AI score0.00364EPSS

SaveExploits0References3

Amd•added 2026/05/12 12:00 a.m.•40 views

AMD Graphics Vulnerabilities – May 2026

CVE Details Refer to Glossary for explanation of terms CVE ID| CVE Description| CVSS Vector ---|---|--- CVE-2024-36323| Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine VM or a process to perform unauthorized access to the register space of the JPEG...

8.8CVSS6.7AI score0.00207EPSS

SaveExploits0

Rapid7 Vulnerability Database (full)•added 2026/05/12 12:00 a.m.•2 views

CVE-2026-4920: Improper Neutralization of Input During Web Page Generation

The Next Date plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'default' shortcode attribute in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...

6.4CVSS6AI score0.00321EPSS

SaveExploits0References2

CNNVD•added 2026/05/12 12:00 a.m.•19 views

WordPress plugin Next Date 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. Versions...

6.4CVSS5.8AI score0.00321EPSS

SaveExploits0References1

NVD•added 2026/05/11 9:18 p.m.•34 views

CVE-2026-37630

An issue in QuickJS-NG v.0.12.1 allows an attacker to execute arbitrary code via the jsmappedargumentsmark function...

7.3CVSS0.00395EPSS

SaveExploits0References1

Patchstack•added 2026/05/11 7:07 p.m.•24 views

WordPress Next Date plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by zaim in WordPress Plugin Next Date versions = 1.0...

6.4CVSS5.8AI score0.00321EPSS

SaveExploits0References1Affected Software1

vulnersOsv•added 2026/05/11 4:21 p.m.•13 views

-shaz-react-rich-text-editor (>=0.1.0, <=0.1.1), 0xmugitea (0.1.0) +845 more potentially affected by CVE-2026-45109 via next (>=15.2.0, <=15.5.16)

next NPM version =15.2.0, =0.1.0, =0.1.0, =0.1.0, =0.1.12, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.7 and more Source cves: CVE-2026-45109 Source advisory: OSV:GHSA-26HH-7CQF-HHC6...

7.5CVSS7.2AI score0.00761EPSS

SaveExploits0

vulnersOsv•added 2026/05/11 4:21 p.m.•10 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +773 more potentially affected by CVE-2026-45109 via next (>=16.0.0, <=16.2.5)

next NPM version =16.0.0, =0.1.0, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.8, =1.1.0-beta.18 and more Source cves: CVE-2026-45109 Source advisory:...

7.5CVSS7.2AI score0.00761EPSS

SaveExploits0

vulnersOsv•added 2026/05/11 4:21 p.m.•13 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +773 more potentially affected by CVE-2026-44575 +1 more via next (>=16.0.0, <=16.2.5)

7.5CVSS7.2AI score0.00761EPSS

SaveExploits0

Snyk•added 2026/05/11 4:21 p.m.•19 views

Authentication Bypass Using an Alternate Path or Channel

Overview next is a react framework. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the middleware.ts with Turbopack enabled. An attacker can gain unauthorized access to protected resources by bypassing authentication mechanisms...

8.7CVSS7.1AI score0.00761EPSS

SaveExploits0References2

vulnersOsv•added 2026/05/11 4:12 p.m.•11 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +772 more potentially affected by CVE-2026-44572 via next (>=16.0.0, <=16.2.4)

5.9CVSS5.6AI score0.00203EPSS

SaveExploits0

Github Security Blog•added 2026/05/11 4:12 p.m.•35 views

Next.js's Middleware / Proxy redirects can be cache-poisoned

Impact Next.js uses the x-nextjs-data request header for internal data requests. On affected versions, an external client could send this header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data...

5.9CVSS5.6AI score0.00203EPSS

SaveExploits0References5Affected Software1

vulnersOsv•added 2026/05/11 3:57 p.m.•8 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +772 more potentially affected by CVE-2026-44581 via next (>=16.0.0, <=16.2.4)

4.7CVSS5.7AI score0.00248EPSS

SaveExploits1

OSV•added 2026/05/11 3:57 p.m.•24 views

GHSA-FFHC-5MCF-PF4Q Next.js vulnerable to cross-site scripting in App Router applications using CSP nonces

Impact App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to...

4.7CVSS5.6AI score0.00248EPSS

SaveExploits1References5

vulnersOsv•added 2026/05/11 3:56 p.m.•8 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +772 more potentially affected by CVE-2026-44582 via next (>=16.0.0, <=16.2.4)

3.7CVSS5.6AI score0.00172EPSS

SaveExploits1

vulnersOsv•added 2026/05/11 3:56 p.m.•7 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +772 more potentially affected by CVE-2026-44582 via next (>=16.0.0, <=16.2.4)

3.7CVSS5.6AI score0.00172EPSS

SaveExploits1

Snyk•added 2026/05/11 3:56 p.m.•32 views

Use of Weak Hash

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Weak Hash via collisions in the rsc cache-busting process. An attacker can manipulate cache entries by crafting requests that cause shared caches to serve incorrect response variants to users. This is...

6.3CVSS5.6AI score0.00172EPSS

SaveExploits1References2

vulnersOsv•added 2026/05/11 3:56 p.m.•6 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +772 more potentially affected by CVE-2026-44580 via next (>=16.0.0, <=16.2.4)

6.1CVSS6.3AI score0.00253EPSS

SaveExploits0

vulnersOsv•added 2026/05/11 3:56 p.m.•10 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +772 more potentially affected by CVE-2026-44580 via next (>=16.0.0, <=16.2.4)

6.1CVSS6.3AI score0.00253EPSS

SaveExploits0

vulnersOsv•added 2026/05/11 3:56 p.m.•8 views

9remote (>=0.1.0, <=0.1.8), @071yoon/log-console-core (0.1.0) +772 more potentially affected by CVE-2026-44579 via next (>=16.0.0, <=16.2.4)

7.5CVSS7.2AI score0.00764EPSS

SaveExploits1

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by