Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownSecurity update for the Linux KernelOpen the advisoryOct 14, 2026
- UnknownPublished: 2026-07-22 Description Description Severity Notes A reflected Cross-Site Scripting (XSS) vulnerability was discovered in Google Cloud Looker.Check if you run itEPSS 0.45%Oct 14, 2026
- UnknownPublished: 2026-09-16 Description Description Severity Notes An Improper Privilege Management vulnerability in Google Security Operations SOAR was patched with version…Check if you run itEPSS 0.23%Oct 14, 2026
- HighGitea SSRF through Git HTTP redirects in mirrors and fetchesCheck if you run itEPSS 0.26%Oct 14, 2026
- MediumIncorrect Authorization in Kibana Leading to Sensitive Information DisclosureCheck if you run itEPSS 0.31%Oct 14, 2026
- HighAuthorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data InterceptionCheck if you run itEPSS 0.34%Oct 14, 2026
- High7.2The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input .Check if you run itEPSS 0.64%Oct 14, 2026
- Critical9.8The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,…Check if you run itEPSS 0.65%Oct 14, 2026
- Medium4.3The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u…Check if you run itEPSS 0.31%Oct 14, 2026
- High8.8The Forms WordPress plugin before 3.0.2 does not sanitise submitted form values on storage, nor escape them before outputting them on the form submissions screen in th…Check if you run itEPSS 0.38%Oct 14, 2026
- Low2.7The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a…Check if you run itEPSS 0.33%Oct 14, 2026
- Medium6.5The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning rout…Check if you run itEPSS 0.21%Oct 14, 2026
- Medium4.3The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authen…Check if you run itEPSS 0.26%Oct 14, 2026
- Medium6.8The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline scrip…Check if you run itEPSS 0.40%Oct 14, 2026
- High8.8The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an…Check if you run itEPSS 0.46%Oct 14, 2026
- Medium5.9The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unatta…Check if you run itEPSS 0.25%Oct 14, 2026
- Medium6.8The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the b…Check if you run itEPSS 0.32%Oct 14, 2026
- Medium5.3The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission befor…Check if you run itEPSS 0.24%Oct 14, 2026
- Medium6.8The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline scr…Check if you run itEPSS 0.32%Oct 14, 2026
- Medium6.4The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versio…Check if you run itEPSS 0.25%Oct 14, 2026
- High7.2The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plu…Check if you run itEPSS 0.31%Oct 14, 2026
- Medium5.3The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter.Check if you run itEPSS 0.28%Oct 14, 2026
- High7.2The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.…Check if you run itEPSS 0.31%Oct 14, 2026
- High7.2The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and includin…Check if you run itEPSS 0.31%Oct 14, 2026
- Critical9.8The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and height)' parameter parameter.Check if you run itEPSS 1.03%Oct 14, 2026