Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes PawFriends - Pet Shop and Veterinary WordPress Theme pawfriends allows Exploiting Incor…Check if you run itEPSS 0.28%Feb 20, 2026
- High7.5Authorization Bypass Through User-Controlled Key vulnerability in cnvrse Cnvrse cnvrse allows Exploiting Incorrectly Configured Access Control Security Levels.This iss…Check if you run itEPSS 0.47%Feb 20, 2026
- Medium6.5Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configur…Check if you run itEPSS 0.37%Feb 20, 2026
- High7.5Authorization Bypass Through User-Controlled Key vulnerability in Shiprocket Shiprocket shiprocket allows Exploiting Incorrectly Configured Access Control Security Lev…Check if you run itEPSS 0.32%Feb 20, 2026
- Low3.8Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.Check if you run itEPSS 0.25%Dec 19, 2025
- Medium4.3Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint.Check if you run itEPSS 0.27%Dec 12, 2025
- Medium4.3GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authe…Check if you run itEPSS 0.24%Dec 11, 2025
- Medium4.3Authorization Bypass Through User-Controlled Key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd.Check if you run itEPSS 0.22%Dec 10, 2025
- High8.1Multiple Incorrect Access Control vulnerabilities in adata Software GmbH Mitarbeiterportal 2.15.2.0 allow remote authenticated, low-privileged users to carry out admin…Check if you run itEPSS 0.54%Dec 9, 2025
- Medium4.3Nextcloud Twofactor WebAuthn is the WebAuthn Two-Factor Provider for Nextcloud.Check if you run itEPSS 0.28%Dec 5, 2025
- Medium4.3Nextcloud talk is a video & audio conferencing app for Nextcloud.Check if you run itEPSS 0.25%Dec 5, 2025
- Medium4.3Nextcloud Tables allows you to create your own tables with individual columns.Check if you run itEPSS 0.28%Dec 5, 2025
- Medium5.3Nextcloud Tables allows you to create your own tables with individual columns.Check if you run itEPSS 0.29%Dec 5, 2025
- Medium4.3Nextcloud Server is a self hosted personal cloud system.Open the advisoryDec 5, 2025
- Low3.3Nextcloud Calendar is a calendar app for Nextcloud.Open the advisoryDec 5, 2025
- High8.3The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user can access…Open the advisoryDec 4, 2025
- Medium4.3The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1…Open the advisoryDec 3, 2025
- Low2.7The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitra…Open the advisoryDec 3, 2025
- Medium6.9Vulnerability in the access control system of the GAMS licensing system that allows unlimited valid licenses to be generated, bypassing any usage restrictions.Open the advisoryDec 2, 2025
- Medium5.4The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a us…Open the advisoryNov 18, 2025
- High7.5Typebot is an open-source chatbot builder.Open the advisoryNov 13, 2025
- High7.5The Payment Plugins Braintree For WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wc-braintree/v1/3ds/v…Open the advisoryNov 12, 2025
- Medium4.3The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version…Open the advisoryNov 12, 2025
- Medium4.3The Wishlist and Save for later for Woocommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.1.22 via…Open the advisoryNov 12, 2025
574 records · page 23 of 23
PreviousNext