CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

29832 matches found

Positive Technologies•added 2026/04/13 12:00 a.m.•5 views

PT-2026-34690

Poppler is a PDF rendering library. Versions prior to 25.06.0 use std::atomic int for reference counting. Because std::atomic int is only 32 bits, it is possible to overflow the reference count and trigger a use-after-free. Version 25.06.0 patches the issue...

5.9CVSS6AI score

SaveExploits0References8

CNNVD•added 2026/04/13 12:00 a.m.•29 views

EspoCRM security vulnerabilities

EspoCRM is an open-source, web-based Customer Relationship Management system CRM developed by EspoCRM. This system offers features such as sales automation, community management, and customer support. EspoCRM versions 9.3.3 and earlier contained security vulnerabilities. These vulnerabilities...

5.4CVSS5.8AI score0.00211EPSS

SaveExploits1References3

Packet Storm•added 2026/04/13 12:00 a.m.•157 views

📄 WBCE CMS Privilege Escalation / Insecure Direct Object Reference

WBCE CMS versions prior to 1.6.4 suffers from insecure direct object reference and privilege escalation vulnerabilities. CVE-2025-65094: WBCE CMS is Vulnerable to Privilege Escalation via Group ID Manipulation IDOR Overview | Field | Details | |---|---| | CVE ID | CVE-2025-65094 | | Severity | HI...

8.8CVSS5.8AI score0.00406EPSS

SaveExploits3

Packet Storm•added 2026/04/13 12:00 a.m.•151 views

📄 ChurchCRM Cross Site Scripting

ChurchCRM versions 6.5.2 and below suffer from a persistent cross site scripting vulnerability in the person property assignment functionality. Note that the advisory says versions 6.3.0 and below are affected but the CVE entry states versions prior to 6.5.3. CVE-2025-67875: ChurchCRM has stored...

8.5CVSS5AI score0.00196EPSS

SaveExploits3

Positive Technologies•added 2026/04/13 12:00 a.m.•19 views

PT-2026-81554

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.65 Description An incorrect reference resolution in the Loader allows a remote attacker to bypass the web origin policy through crafted network traffic. The web origin policy is a security mechanism...

9.8CVSS6.3AI score0.00622EPSS

SaveExploits2References385

Positive Technologies•added 2026/04/13 12:00 a.m.•25 views

PT-2026-72433

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A device reference leak exists in the host1x device parse dt error path. In host1x device add, if host1x device parse dt fails, the error path uses kfreedevice to free the object directl...

4.6CVSS5.6AI score0.00231EPSS

SaveExploits0

Patchstack•added 2026/04/12 11:23 p.m.•25 views

WordPress Tutor LMS plugin <= 3.9.7 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Course Content Modification vulnerability

Authenticated Subscriber+ Insecure Direct Object Reference to Arbitrary Course Content Modification vulnerability discovered by Hunter Jensen skid in WordPress Plugin Tutor LMS versions = 3.9.7...

4.3CVSS5.8AI score0.00358EPSS

SaveExploits0References1Affected Software1

Patchstack•added 2026/04/12 11:15 p.m.•21 views

WordPress YITH WooCommerce Wishlist plugin < 4.13.0 - Unauthenticated Arbitrary Wishlist Renaming via IDOR vulnerability

Unauthenticated Arbitrary Wishlist Renaming via IDOR vulnerability discovered by Chiao-Lin Yu Steven Meow in WordPress Plugin YITH WooCommerce Wishlist versions 4.13.0...

6.5CVSS5.8AI score0.00226EPSS

SaveExploits0References1Affected Software1