Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.3SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_playlist.php.Check if you run itEPSS 0.17%Apr 16, 2026
- High7.3SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_music.php.Check if you run itEPSS 0.17%Apr 16, 2026
- Critical9.1@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled.Check if you run itEPSS 0.28%Apr 16, 2026
- High7.5A NULL pointer dereference vulnerability exists in fio (Flexible I/O Tester) v3.41 when parsing job files containing the fdp_pli option.Check if you run itEPSS 0.28%Apr 16, 2026
- High7.1An issue in the Forgot Password feature of Daylight Studio FuelCMS v1.5.2 allows unauthenticated attackers to obtain the password reset token of a victim user via a cr…Check if you run itEPSS 0.26%Apr 16, 2026
- Medium6.4The Email Encoder – Protect Email Addresses and Phone Numbers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eeb_mailto' shortcode in all v…Check if you run itEPSS 0.26%Apr 16, 2026
- Medium5.3@fastify/static versions 8.0.0 through 9.1.0 allow path traversal when directory listing is enabled via the list option.Check if you run itEPSS 0.51%Apr 16, 2026
- Critical9.1@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances.Check if you run itEPSS 0.50%Apr 16, 2026
- High8.1Zohocorp ManageEngine PAM360 versions before 8531 and ManageEngine Password Manager Pro versions from 8600 to 13230 are vulnerable to Authenticated SQL injection in th…Check if you run itEPSS 1.39%Apr 16, 2026
- Medium5.3The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference via t…Check if you run itEPSS 0.30%Apr 16, 2026
- High7.5JWT Tokens used by tasks were exposed in logs.Check if you run itEPSS 0.74%Apr 16, 2026
- Medium5.9@fastify/static versions 8.0.0 through 9.1.0 decode percent-encoded path separators (%2F) before filesystem resolution, while Fastify's router treats them as literal characters.Check if you run itEPSS 0.42%Apr 16, 2026
- Critical10.0Improper Access ControlPatch nowKEVEPSS 1.38%Apr 16, 2026
- Medium5.7Insufficiently Protected Credentials in Sparx Systems Pty Ltd.Check if you run itEPSS 0.11%Apr 16, 2026
- High7.5The DirectoryPress – Business Directory And Classified Ad Listing plugin for WordPress is vulnerable to SQL Injection via the 'packages' parameter in versions up to, a…Check if you run itEPSS 0.39%Apr 16, 2026
- Medium5.4The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded image title in versions up to, and…Check if you run itEPSS 0.26%Apr 16, 2026
- Low3.1The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 3.8.0.Check if you run itEPSS 0.32%Apr 16, 2026
- Medium5.4Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server.Check if you run itEPSS 0.18%Apr 16, 2026
- Medium6.1The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.Check if you run itEPSS 0.23%Apr 16, 2026
- High7.5The component accepts XML input through the publisher without disabling external entity resolution.Check if you run itEPSS 0.27%Apr 16, 2026
- Medium5.4The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding.Check if you run itEPSS 0.19%Apr 16, 2026
- Medium6.1The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.Check if you run itEPSS 0.24%Apr 16, 2026
- High7.3Dell Storage Manager - Replay Manager for Microsoft Servers, version(s) 8.0, contain(s) an Improper Privilege Management vulnerability.Check if you run itEPSS 0.12%Apr 16, 2026
- Critical9.1The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities.Check if you run itEPSS 0.38%Apr 16, 2026
- Medium5.3The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa…Check if you run itEPSS 0.28%Apr 16, 2026
Sort