Why vulnerability monitoring is critical for your business
In 2025, 48,185 new vulnerabilities (CVEs) were published — a 20% increase compared to 2024. In 2026, the trend is accelerating further. Every day, more than 130 flaws are made public, some of which affect the software your business uses daily.
According to the Verizon Data Breach Investigations Report, 60% of data breaches exploit vulnerabilities for which a patch already existed at the time of the attack. The problem is not the absence of patches — it is the absence of monitoring. No IT team can manually track 130 CVEs per day.
Avec CVE Find, explorez la plus grande base de données de vulnérabilités au monde.
Le CVE (Common Vulnerabilities and Exposures) est une liste de failles de sécurité informatique divulguées publiquement. Le programme CVE a pour objectif de faciliter le partage des données entre les différentes capacités de détection des vulnérabilités, qu'il s'agisse d'outils, de bases de données ou de services. Il fournit également une norme pour évaluer la couverture de ces outils et services.
Accédez à CVE Find
What CVE Find does for you
How can I be alerted in real time?
CVE Find notifies you by email and SMS as soon as a vulnerability affects your products. Configurable frequency: from instant alerts to monthly summaries.
Are my software products vulnerable?
Configure your products (CMS, servers, libraries) via the CPE catalogue. CVE Find continuously monitors the MITRE database and alerts you automatically. 338,000+ CVEs indexed.
How do I prioritise patches?
CVSS scoring (severity) and EPSS (probability of real-world exploitation) show you what to fix first. No more false positives.
Which vulnerabilities are being actively exploited?
The integrated CISA KEV catalogue identifies vulnerabilities already exploited in the wild. These are the flaws to fix with absolute top priority.
Is the platform available in English?
Yes. CVE Find is available in French, English and German. Developed in Switzerland by Bexxo, it is the only comprehensive French-language CVE platform.
Is the data reliable and up to date?
Real-time synchronisation with MITRE, NVD, CISA and FIRST.org. More than 48,000 CVEs added in 2025, and the database is enriched every hour.
Stay ahead with the latest critical security vulnerabilities.
CVE-2026-18438 - HIGH
15/08/2026
The Templately – Elementor & Gutenberg Template Library: 6500+ Free & Pro Ready Templates And Cloud! plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.7.1 via the fetch_remote_file function. This is due to a filename validation/destination mismatch in fetch_remote_file, where file type validation is performed against the attacker-controlled Conte...
fileinclusionOWSAP: A04
CVE-2026-16142 - CRITICAL
15/08/2026
The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the add_front_user_update() AJAX handler being registered for unauthenticated users and accepting an arbitrary truebooker_wp_user_id value, which is passed directly to wp_update_user() without verifying authentication or ownership. This makes it possible for unauthentic...
authorisationproblemOWSAP: A01
CVE-2026-14279 - HIGH
15/08/2026
The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the frontend) and that the caller has a positive user ID, then calls WP_User::add_role...
priviliegemanagementOWSAP: A04
CVE-2026-15826 - CRITICAL
15/08/2026
The User Profile Builder plugin for WordPress is vulnerable to Authentication Bypass via Type Confusion in versions up to, and including, 3.16.4. This is due to the wppb_log_in_user() function calling absint() on the return value of wp_insert_user() before performing an is_wp_error() check — when a registration is submitted with a 61–70 character username, WordPress core rejects it with a WP_E...
CVE-2026-15965 - HIGH
15/08/2026
The MaxUpload – Big File Uploads – Increase Maximum File Upload Size plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.4.0 via the handle_upload function. This is due to a filename-validation mismatch in the handle_upload function where extension and MIME checks are applied to the uploaded chunk's filename but not to the final assembled filenam...
fileinclusionOWSAP: A04
CVE-2026-15341 - CRITICAL
15/08/2026
The User Session Synchronizer plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions up to, and including, 1.4.0. The `synchronize_session()` function, hooked on `init` and therefore executed on every request, performs no nonce, capability, or shared-secret validation against the attacker-supplied `ussync-key`, `ussync-token`, and `ussync-ref` param...
authorisationproblemOWSAP: A07
CVE-2026-15312 - HIGH
15/08/2026
The Propovoice: All-in-One Client Management System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.7.8. This is due to the `create()` function's REST endpoint failing to validate the user-supplied `role` parameter against an allowlist of permitted WordPress roles and omitting any `promote_users` capability check before passing the sanitized value...
priviliegemanagementOWSAP: A04
CVE-2026-15303 - CRITICAL
15/08/2026
The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the six_storage_create_wp_user() AJAX handler being registered on wp_ajax_nopriv_six_storage_create_wp_user without any nonce, capability, credential, or ownership verification, while calling wp_set_current_user() and wp_set_auth_cookie() for any WordPress user ...
authorisationproblemOWSAP: A07
CVE-2026-15001 - HIGH
15/08/2026
The bLoyal: Loyalty & Promotions by bLoyal plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.611.78. This is due to the AJAX actions `save_bloyal_configuration_data` and `save_bloyal_accesskeyverification_data` being registered without any capability or nonce checks, and the `bloyal_customer_auto_login` function unconditionally trusting the `Custo...
priviliegemanagementOWSAP: A04
CVE-2026-14484 - CRITICAL
15/08/2026
The RapiSafe – Secure Multi File Upload for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handleAjaxRemoveUpload function in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the ri...
directorytraversalOWSAP: A01
CVE-2026-73683 - CRITICAL
14/08/2026
Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Attackers who obtain a valid, unexpired id_token issued for the same Facebook App ID can submit the captured token to the backe...
OWSAP: A07
CVE-2026-73682 - HIGH
14/08/2026
Semaphore versions prior to 2.18.20 contain an OS command injection (argument injection) vulnerability in the repository git_url handling that allows authenticated users holding the Manager or Owner role on any project to achieve remote code execution on the Semaphore server host. Attackers can craft a malicious git_url value using git's --upload-pack= option to inject and execute arbitrary shell ...
OWSAP: A03
CVE-2026-73680 - HIGH
14/08/2026
Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sani...
oscommandinjectionOWSAP: A03
CVE-2026-17186 - CRITICAL
14/08/2026
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary CL commands due to improper neutralization of special elements in a command.
oscommandinjectionOWSAP: A03
CVE-2026-17184 - CRITICAL
14/08/2026
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path.
OWSAP: A04
CVE-2026-17182 - CRITICAL
14/08/2026
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to bypass authentication and obtain or alter sensitive information due to improper validation of request URI path segments.
authorisationproblemOWSAP: A07
CVE-2026-17181 - CRITICAL
14/08/2026
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write files to arbitrary locations due to path traversal.
directorytraversalOWSAP: A01
CVE-2026-17179 - HIGH
14/08/2026
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service due to command injection.
oscommandinjectionOWSAP: A03
CVE-2026-17081 - HIGH
14/08/2026
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to write arbitrary files due to improper limitation of a pathname to a restricted directory.
directorytraversalOWSAP: A01
CVE-2026-16879 - HIGH
14/08/2026
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to improper authorization using user-supplied input.
OWSAP: A01
