Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8ninjaforms ninja_forms_file_uploads Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 62.90%Apr 6, 2026
- Critical9.3topsecgroup tianxin_internet_behavior_management_system Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 6.17%Apr 6, 2026
- Critical9.8Fortinet FortiClient EMS Improper Access Control VulnerabilityPatch nowKEVEPSS 93.98%Apr 3, 2026
- Critical9.8Customer Managed ShareFile Storage Zones Controller (SZC) allows an unauthenticated attacker to access restricted configuration pages.Patch nowKEVEPSS 3.18%Apr 2, 2026
- Critical9.3metinfo metinfo Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 4.50%Apr 1, 2026
- Critical9.8The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12.Patch nowKEVEPSS 4.43%Mar 31, 2026
- High8.8Google Dawn Use-After-Free VulnerabilityPatch nowKEVEPSS 0.70%Mar 31, 2026
- High7.5The Gravity SMTP plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4.Patch nowKEVEPSS 2.24%Mar 31, 2026
- Low2.1A flaw has been found in Tenda CH22 1.0.0.1.Patch nowKEVEPSS 6.47%Mar 30, 2026
- Critical9.8supsystic contact_form Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 32.78%Mar 30, 2026
- Critical9.8Nginx UI is a web user interface for the Nginx web server.Patch nowKEVEPSS 2.52%Mar 30, 2026
- High7.8TrueConf Client Download of Code Without Integrity Check VulnerabilityPatch nowKEVEPSS 0.33%Mar 30, 2026
- High8.6XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users.Patch nowKEVEPSS 0.90%Mar 30, 2026
- High8.8Langflow Langflow Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 4.76%Mar 27, 2026
- Medium5.3The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing dataPatch nowKEVEPSS 0.68%Mar 26, 2026
- Medium6.5Responsive Plus Ajax Action Arbitrary Shortcode Execution VulnerabilityPatch nowKEVEPSS 0.33%Mar 26, 2026
- High8.8The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2.Patch nowKEVEPSS 0.57%Mar 26, 2026
- Medium6.5pickplugins product_slider_for_woocommerce Missing AuthorizationPatch nowKEVEPSS 0.35%Mar 25, 2026
- High8.7A SQL Injection vulnerability has been found in Support Board v3.7.7.Patch nowKEVEPSS 0.25%Mar 25, 2026
- High8.7Langflow is a tool for building and deploying AI-powered agents and workflows.Patch nowKEVEPSS 2.03%Mar 24, 2026
- Critical9.9Langflow is a tool for building and deploying AI-powered agents and workflows.Patch nowKEVEPSS 1.09%Mar 24, 2026
- Critical9.8Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')Patch nowKEVEPSS 1.03%Mar 24, 2026
- Critical10.0WWBN AVideo is an open source video platform.Patch nowKEVEPSS 11.24%Mar 23, 2026
- Critical9.3Citrix NetScaler Out-of-Bounds Read VulnerabilityPatch nowKEVEPSS 4.04%Mar 23, 2026
- Medium5.3The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file.Patch nowKEVEPSS 0.30%Mar 23, 2026
Sort