Browse 340,202+ CVEs from NVD & CNNVD with AI-powered analysis, AI-generated PoCs, KEV/EPSS tracking, and daily security intelligence. Filter by vendor, product, severity, or CWE.
| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-12176 | SourceCodester CET Automated Grading System with AI Predictive Analytics index.php cross site scripting | SourceCodester | CET Automated Grading System with AI Predictive Analytics | Medium | 4.3 | 2026-06-13 23:15:11 | Deep Dive |
| CVE-2026-12175 | CodeAstro Student Attendance Management System createStudents.php sql injection | CodeAstro | Student Attendance Management System | Medium | 4.7 | 2026-06-13 22:45:06 | Deep Dive |
| CVE-2026-12174🧪 | D-Link DCS-935L HTTP rhea snprintf format string | D-Link | DCS-935L | High | 8.8 | 2026-06-13 20:15:12 | Deep Dive |
| CVE-2026-12183🧪 | BUK TS-G系统2.9.1-2.10.2认证漏洞 | Nefteprodukttekhnika LLC | BUK TS-G Gas Station Automation System | Critical | 9.8 | 2026-06-13 17:36:49 | Deep Dive |
| CVE-2026-6428 | CVE-2026-6428 | Koha Community | Koha | High | 7.6 | 2026-06-13 16:34:10 | Deep Dive |
| CVE-2026-5513 | Online Scheduling and Appointment Booking System – Bookly <= 27.2 - Unauthenticated Stored Cross-Site Scripting via 'bookly-customer-full-name' Cookie | ladela | Online Scheduling and Appointment Booking System – Bookly | High | 7.2 | 2026-06-13 11:25:25 | Deep Dive |
| CVE-2026-11624 | Model Context Protocol <v0.25.0 缺少源验证漏洞 | MCP Toolbox for Databases | - | - | 2026-06-13 08:38:43 | Deep Dive | |
| CVE-2026-1291 | Meow Gallery <= 5.4.4 - Missing Authorization to Authenticated (Author+) Shortcode creation | tigroumeow | Meow Gallery | Medium | 4.3 | 2026-06-13 08:29:41 | Deep Dive |
| CVE-2026-3297 | Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block | softaculous | Page Builder: Pagelayer – Drag and Drop website builder | Medium | 6.4 | 2026-06-13 07:51:22 | Deep Dive |
| CVE-2026-9629 | Canvas <= 2.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Block Attribute | codesupplyco | Canvas | Medium | 6.4 | 2026-06-13 07:51:22 | Deep Dive |
| CVE-2026-2470 | Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts' | softaculous | Page Builder: Pagelayer – Drag and Drop website builder | Medium | 4.3 | 2026-06-13 07:51:22 | Deep Dive |
| CVE-2026-9134 | Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode Parameter | fooplugins | Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel | Medium | 6.4 | 2026-06-13 06:48:00 | Deep Dive |
| CVE-2026-9062 | Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal | Unknown | Store Locator WordPress | - | - | 2026-06-13 06:00:02 | Deep Dive |
| CVE-2026-9061 | Agile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_name | Unknown | Store Locator WordPress | - | - | 2026-06-13 06:00:02 | Deep Dive |
| CVE-2026-9109 | GPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage | john-dagelmore | GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites | High | 7.2 | 2026-06-13 05:32:37 | Deep Dive |
| CVE-2026-11769 | Operator - Namespaced User Path Traversal | Grafana | Grafana Operator | - | - | 2026-06-13 04:17:41 | Deep Dive |
| CVE-2026-54231 | Abrt: unsanitized systemd journal content written to dump directory files enables content injection | Red Hat | Red Hat Enterprise Linux 6 | Medium | 5.5 | 2026-06-13 02:34:37 | Deep Dive |
| CVE-2026-54230 | Abrt: event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites | Red Hat | Red Hat Enterprise Linux 6 | High | 7.0 | 2026-06-13 02:34:36 | Deep Dive |
| CVE-2026-54229 | Abrt: chownproblemdir succeeds during active post-create event processing due to inadequate locking | Red Hat | Red Hat Enterprise Linux 6 | High | 7.0 | 2026-06-13 02:34:31 | Deep Dive |
| CVE-2026-54228 | Abrt: toctou race condition in abrt-dbus setelement allows arbitrary file writes to dump directories | Red Hat | Red Hat Enterprise Linux 6 | High | 7.8 | 2026-06-13 02:34:25 | Deep Dive |