# Vulnerability search

> Vulnerability search is a free lookup for every published CVE, over 400,000 of them. Type an ID to see how severe a flaw is, whether criminals are using it, how likely it is to be used and what it affects. It's for anyone who needs a clear answer quickly, with no account.

Canonical page: https://www.edgeprotect.io/cve-search

## How to look one up

Go to `https://www.edgeprotect.io/what-is/<CVE-ID>` (upper case, like CVE-2024-3400), for example [CVE-2021-44228](https://www.edgeprotect.io/what-is/CVE-2021-44228), [CVE-2024-3400](https://www.edgeprotect.io/what-is/CVE-2024-3400) or [CVE-2023-4966](https://www.edgeprotect.io/what-is/CVE-2023-4966). Only CVE IDs work here (the year, then a number). To browse by product or maker, use the software maker pages below.

Every CVE page shows:

- **Is it being used in attacks?** Whether it's on the government list of exploited flaws, and the action that list asks for.
- **How bad it is.** The CVSS score and what goes into it, explained.
- **How likely it is to be used.** The latest exploit-likelihood score, with its history.
- **What it affects.** The products and versions, the type of weakness and related flaws.

## Just published

The 20 most recently published CVEs, newest first (2 with a CVSS score of 7 or above). The rating beside each score is the CVSS rating (0 to 10), not the EdgeProtect risk score.

| CVE | Published | CVSS score (rating) | Summary |
|---|---|---|---|
| [CVE-2026-11328](https://www.edgeprotect.io/what-is/CVE-2026-11328) | 7 Jul 2026 | 6.4 (CVSS Medium) | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title parameter in all versions up to, and including, 2.7.9.8 due to insufficient input sanitization and… |
| [CVE-2026-53648](https://www.edgeprotect.io/what-is/CVE-2026-53648) | 7 Jul 2026 | Not scored yet | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.1, downloadable product files are stored using a deterministic filename-derived path. When an administrator uploads a file… |
| [CVE-2026-53647](https://www.edgeprotect.io/what-is/CVE-2026-53647) | 7 Jul 2026 | Not scored yet | FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is accessible without authentication. Any caller with a valid API… |
| [CVE-2026-13356](https://www.edgeprotect.io/what-is/CVE-2026-13356) | 7 Jul 2026 | Not scored yet | A malicious webpage could interrupt a pending navigation by enqueuing a synchronous JavaScript dialog, causing the browser UI to display the destination origin in the address bar while continuing to render… |
| [CVE-2024-56141](https://www.edgeprotect.io/what-is/CVE-2024-56141) | 7 Jul 2026 | 5.0 (CVSS Medium) | Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the CryptManager encryption routine ( CryptManager.kt ) initializes… |
| [CVE-2026-53646](https://www.edgeprotect.io/what-is/CVE-2026-53646) | 6 Jul 2026 | Not scored yet | FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when a `ClientPasswordReset` record already exists for a client (from a previous unexpired reset request)… |
| [CVE-2026-53645](https://www.edgeprotect.io/what-is/CVE-2026-53645) | 6 Jul 2026 | Not scored yet | FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow a low-privileged staff account to grant arbitrary module permissions to itself through the admin API, resulting in… |
| [CVE-2026-53644](https://www.edgeprotect.io/what-is/CVE-2026-53644) | 6 Jul 2026 | Not scored yet | FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticated clients to both read and reset API key service secrets for orders that are no longer in an… |
| [CVE-2026-53643](https://www.edgeprotect.io/what-is/CVE-2026-53643) | 6 Jul 2026 | Not scored yet | FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin API endpoints. The root cause is a… |
| [CVE-2026-53642](https://www.edgeprotect.io/what-is/CVE-2026-53642) | 6 Jul 2026 | Not scored yet | FOSSBilling is a free, open-source billing and client management system. In versions 0.5.6 through 0.7.2, when the "Require Email Confirmation" setting is enabled, a logged-in client with an unverified email address… |
| [CVE-2026-53641](https://www.edgeprotect.io/what-is/CVE-2026-53641) | 6 Jul 2026 | Not scored yet | FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) vulnerability in the client-facing email history views of FOSSBilling. Email… |
| [CVE-2026-53640](https://www.edgeprotect.io/what-is/CVE-2026-53640) | 6 Jul 2026 | Not scored yet | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, low-privileged staff accounts may read sensitive data via admin API endpoints that lack permission checks. While sibling… |
| [CVE-2026-59710](https://www.edgeprotect.io/what-is/CVE-2026-59710) | 6 Jul 2026 | 6.1 (CVSS Medium) | showdown contains a stored cross-site scripting vulnerability in the parseHeaders function of src/subParsers/makehtml/tables.js that fails to properly escape table header ID attributes. Attackers can inject arbitrary… |
| [CVE-2026-43928](https://www.edgeprotect.io/what-is/CVE-2026-43928) | 6 Jul 2026 | Not scored yet | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, the PayPalEmail payment adapter accepts PayPal IPN callbacks and credits the IPN-supplied amount (`mc_gross`) to the… |
| [CVE-2026-43927](https://www.edgeprotect.io/what-is/CVE-2026-43927) | 6 Jul 2026 | Not scored yet | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, a race condition in the cart checkout flow allows an authenticated client to apply a promo code beyond its configured… |
| [CVE-2026-43925](https://www.edgeprotect.io/what-is/CVE-2026-43925) | 6 Jul 2026 | Not scored yet | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, an unauthenticated mass assignment vulnerability in the client self-registration endpoint allows any visitor to assign… |
| [CVE-2026-43921](https://www.edgeprotect.io/what-is/CVE-2026-43921) | 6 Jul 2026 | Not scored yet | FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's `Config::prettyPrintArrayToPHP()` method. When… |
| [CVE-2026-43918](https://www.edgeprotect.io/what-is/CVE-2026-43918) | 6 Jul 2026 | Not scored yet | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, when a client or staff/admin account is suspended or marked inactive, existing authenticated sessions are not invalidated… |
| [CVE-2026-42204](https://www.edgeprotect.io/what-is/CVE-2026-42204) | 6 Jul 2026 | 8.8 (CVSS High) | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. From 4.0.0-beta.471 through 4.0.0-beta.473, a regression in SHELL_SAFE_COMMAND_PATTERN allowed ampersands in custom… |
| [CVE-2026-42153](https://www.edgeprotect.io/what-is/CVE-2026-42153) | 6 Jul 2026 | 8.8 (CVSS High) | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL healthcheck command generation used attacker-controlled database settings… |

## How to read a CVE

**What is a CVE?** A CVE is a public ID for one known security flaw in one piece of software, written like CVE-2024-3400. The ID lets everyone, from the maker to your IT team, talk about the same problem.

**What does the CVSS score tell me?** CVSS rates how bad a flaw could be, from 0 to 10, if someone used it. It describes the flaw in theory. It says nothing about whether anyone is actually using it.

**Why isn't severity enough?** Thousands of flaws score high, and most are never used against anyone. Fixing by severity alone buries the few that criminals are using today. Under 1% of all CVEs reach Critical on our risk score.

**What makes a flaw urgent?** Evidence it's being used in real attacks. Our risk score weighs that first, then severity, exposure and threat activity. Anything confirmed exploited is marked for an emergency patch, whatever its score.

### The EdgeProtect risk score, 0 to 100

Kept up to date for every CVE as the evidence changes.

| Band | Score |
|---|---|
| Critical | 85 and above |
| High | 70 to 84 |
| Medium | 40 to 69 |
| Low | 20 to 39 |
| Info | 0 to 19 |

It considers four things: evidence it's being exploited counts most, then how severe it is, then how exposed it is and threat activity.

## Watch the ones that affect you

Over 400,000 flaws have been published, and new ones arrive every day. A free account turns the whole catalogue into the handful that touch your business, in the order to fix them:

1. **Tell us what you run.** Pick your software from a catalogue, or let us work it out from your website. You check the list before anything is saved.
2. **We match and rank.** Every flaw in that software gets a risk score from 0 to 100, led by evidence that criminals are using it, then how severe it is and how many products it reaches.
3. **You hear about new ones.** An alert by email, in the app or by webhook as soon as we spot a new flaw in something you use.

Free plan, no card needed: https://www.edgeprotect.io/register

## Start somewhere else

- Threat groups: https://www.edgeprotect.io/threat-actors, for example these state-backed groups: [Lazarus Group](https://www.edgeprotect.io/threat-actors/lazarus-group) (North Korea), [APT28](https://www.edgeprotect.io/threat-actors/apt28) and [APT29](https://www.edgeprotect.io/threat-actors/apt29) (Russia), [APT41](https://www.edgeprotect.io/threat-actors/apt41) (China), [APT33](https://www.edgeprotect.io/threat-actors/apt33) (Iran)
- Industries: https://www.edgeprotect.io/industries
- Software makers, for example https://www.edgeprotect.io/vendors/microsoft, https://www.edgeprotect.io/vendors/apache, https://www.edgeprotect.io/vendors/fortinet
- Products, for example https://www.edgeprotect.io/product/microsoft/windows_10, https://www.edgeprotect.io/product/apache/log4j

## Questions people ask

**Do I need an account to search?**
No. You can look up any CVE, threat group, industry or software maker without an account.

**How up to date is it?**
It covers every published CVE, over 400,000 of them, and we keep watching for new ones. The list on this page shows the most recently published.

**What is the EdgeProtect risk score?**
A score from 0 to 100 that we keep up to date for every CVE as the evidence changes. Evidence the flaw is being exploited counts most, then how severe it is, then how widely exposed it is and related threat activity. 85 and above is Critical.

**Can I get told when a flaw affects my software?**
Yes. Tell us the software you use and we match new flaws to it, rank them and tell you as soon as we spot one, by email, in the app or by webhook.

**Can I use this data in my own tools?**
Yes. Our REST API and MCP server for AI assistants cover CVEs, exploitation evidence, threat groups and more.

**Is a high CVSS score the same as high risk?**
No. CVSS describes how bad a flaw could be in theory. Our risk score adds whether it is being used in real attacks, so you can fix the ones most likely to hurt you first.

## Links

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact