Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Unknownmetagauss registrationmagic Improper Privilege ManagementPatch nowKEVEPSS 1.65%May 4, 2026
- Unknownsitesao dhvc_form Incorrect Privilege AssignmentPatch nowKEVEPSS 0.55%May 4, 2026
- Unknowncontempothemes real_estate_7 Incorrect Privilege AssignmentPatch nowKEVEPSS 0.78%May 4, 2026
- UnknownFavethemes homey Improper Privilege ManagementPatch nowKEVEPSS 0.43%May 4, 2026
- High7.2brizy brizy Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.43%May 2, 2026
- Critical9.2Rclone is a command-line program to sync files and directories to and from different cloud storage providers.Patch nowKEVEPSS 3.22%Apr 23, 2026
- Unknownmjdm majordomo Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 5.70%Apr 18, 2026
- High7.2The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_source' parameter in all versions up to, and including, 14.16.4.Patch nowKEVEPSS 0.42%Apr 17, 2026
- Medium6.5Fortinet Multiple Products Path Traversal VulnerabilityPatch nowKEVEPSS 1.08%Apr 14, 2026
- Critical9.8WPEverest everest_forms Deserialization of Untrusted DataPatch nowKEVEPSS 2.98%Apr 8, 2026
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.38%Apr 8, 2026
- Critical9.3nextendweb smart_slider_3 Embedded Malicious CodePatch nowKEVEPSS 0.97%Apr 7, 2026
- High8.7LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format.Patch nowKEVEPSS 3.98%Apr 6, 2026
- UnknownStrapi Strapi Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Patch nowKEVEPSS 70.60%Apr 4, 2026
- Unknownthimpress learnpress Exposure of Sensitive Information to an Unauthorized ActorPatch nowKEVEPSS 1.05%Mar 31, 2026
- High8.6XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users.Patch nowKEVEPSS 0.90%Mar 30, 2026
- High8.8The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2.Patch nowKEVEPSS 0.57%Mar 26, 2026
- Critical10.0WWBN AVideo is an open source video platform.Patch nowKEVEPSS 11.24%Mar 23, 2026
- High8.1The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7.Patch nowKEVEPSS 0.56%Mar 21, 2026
- High7.5NSquared simply_schedule_appointments Missing AuthorizationPatch nowKEVEPSS 0.52%Mar 13, 2026
- UnknownVinga WR-AC1200 Password Parameter VulnerabilityPatch nowKEVEPSS 1.57%Mar 11, 2026
- UnknownASUS asuswrt Missing AuthorizationPatch nowKEVEPSS 85.16%Mar 11, 2026
- Critical9.1Budibase is a low code platform for creating internal tools, workflows, and admin panels.Patch nowKEVEPSS 2.19%Mar 9, 2026
- Critical9.8The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon.Patch nowKEVEPSS 0.67%Mar 9, 2026
- Critical9.8WPEverest user_registration_\&_membership Improper Privilege ManagementPatch nowKEVEPSS 28.54%Mar 2, 2026
Sort