high8.4
Your agent Now with CVE context
Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.
Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tabORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV
Find vulnerabilities that affect you.
Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.
Severity
328 matching advisories · 30 shown
Follow substantive record changes →SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
medium6.5
high7.1
CVE-2026-119331
Ladybird: Missing origin-clean enforcement in CSSStyleSheet allows cross-origin CSS read and mutation
LadybirdBrowser · ladybird
high7.5
CVE-2026-110305
Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injection
hwk-fr · Advanced Custom Fields: Extended
critical9.3
CVE-2026-61730
SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount
socfortress · CoPilot
low3.1
CVE-2026-119570
Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses
parse-community · parse-server
high8.2
CVE-2026-14467
Display of information in the Forocoches comments editor
Forocoches · Forocoches comments editor
medium5.3
CVE-2026-118100
BuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure
Unknown · BuddyForms
medium4.4
CVE-2026-114444
Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer
Unknown · Security Plugin, Firewall & Malware Scanner with Auto Removal
medium5.9
CVE-2026-119199Fix available
Nuxt dev server exposes private runtime config through the Nitro dev bundle
high7.5
high7.5
low3.1
CVE-2026-119125
Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 Information Disclosure via beforeSave Reverted Fields
parse-community · parse-server / parse-community · parse-server
medium6.5
medium5.3
CVE-2026-113693
System Account Credential Disclosure in BMC ITSM
BMC · BMC IT Service Management Suite
medium5.3
CVE-2026-92086
MW WP Form <= 5.1.7 - Unauthenticated Sensitive Information Exposure in 'post_id' Parameter
websoudan · MW WP Form
medium5.3
CVE-2026-91153
Everest Forms <= 3.6.2 - Unauthenticated Sensitive Information Exposure via Smart-Tag Injection in Smart-Tag Injection in Form Field Values ({post_meta key=...})
wpeverest · Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
medium5.3
CVE-2026-117688
Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration
Red Hat · Red Hat Build of Keycloak / Red Hat · Red Hat Build of Keycloak
medium5.3
CVE-2026-114270
GeoDirectory < 2.8.197 - Unauthenticated Password-Protected Listing Content Disclosure
Unknown · GeoDirectory
low3.7
CVE-2026-108686
WP Post Author < 4.2.0 - Unauthenticated reCAPTCHA Secret Key Disclosure
Unknown · WP Post Author
medium5.3
CVE-2026-78396
Link Library < 7.10.0 - Unauthenticated Link Contact and Submitter Information Disclosure
Unknown · Link Library
medium5.3
CVE-2026-115282
Recipe Card Blocks Lite 2.6.4 - 3.6.3 - Unauthenticated Unpublished Post Content Disclosure
Unknown · Recipe Card Blocks Lite
medium5.3
CVE-2026-40063
A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809).
frangoteam · Frangoteam
medium5.3
CVE-2026-118578
maotoumao MusicFreeDesktop Request Forwarder information disclosure
maotoumao · MusicFreeDesktop
medium6.0
critical9.4
CVE-2026-63190
FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
fearlessgeekmedia · FearlessCMS
medium5.7
CVE-2026-105617
PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule
DALIBO · PostgreSQL Anonymizer
medium5.7
CVE-2026-105616
PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting
DALIBO · PostgreSQL Anonymizer
low2.7
CVE-2026-113494
GeoDirectory < 2.8.195 - Contributor+ Non-Public Listing Disclosure via gd_post_content Shortcode
Unknown · GeoDirectory
medium5.3
CVE-2026-110509
Essential Addons for Elementor < 6.8.7 - Unauthenticated Private Post Meta Disclosure via load_more AJAX Handler
Unknown · Essential Addons for Elementor