Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.1Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form b…Check if you run itEPSS 0.10%Apr 15, 2026
- Medium5.3Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.T…Check if you run itEPSS 0.18%Apr 15, 2026
- High7.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite…Check if you run itEPSS 0.24%Apr 15, 2026
- High8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows…Check if you run itEPSS 0.23%Apr 15, 2026
- Medium5.3Missing Authorization vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Exploiting Incorrectly Configured Access Control Security Levels.This is…Check if you run itEPSS 0.19%Apr 15, 2026
- Medium5.4Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: fr…Check if you run itEPSS 0.18%Apr 15, 2026
- Medium5.3Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly Configured Access Control S…Check if you run itEPSS 0.22%Apr 15, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zahlan Categories Images categories-images allows DOM-Based XSS.T…Check if you run itEPSS 0.14%Apr 15, 2026
- Medium5.3Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Security Le…Check if you run itEPSS 0.20%Apr 15, 2026
- Medium4.3Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issu…Check if you run itEPSS 0.15%Apr 15, 2026
- Medium4.3Missing Authorization vulnerability in BlockArt Magazine Blocks magazine-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe…Check if you run itEPSS 0.15%Apr 15, 2026
- High8.1Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to validate CSRF tokens on an authentication endpoint which allows a…Check if you run itEPSS 0.13%Apr 15, 2026
- Low2.7Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server c…Check if you run itEPSS 0.17%Apr 15, 2026
- High7.5The SkyWalking OAP /debugging/config/dump endpoint may leak sensitive configuration information of MySQL/PostgreSQL.Check if you run itEPSS 0.55%Apr 15, 2026
- Critical9.1Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled.Check if you run itEPSS 0.49%Apr 15, 2026
- Critical9.1@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins.Check if you run itEPSS 0.45%Apr 15, 2026
- High7.5Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessive amounts of disk space via network interface.Check if you run itEPSS 0.47%Apr 15, 2026
- Critical9.0@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequCheck if you run itEPSS 0.46%Apr 15, 2026
- Medium6.4The VI: Include Post By plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_container' attribute of the 'include-post-by-cat' shortcode in…Check if you run itEPSS 0.26%Apr 15, 2026
- High7.2The Quick Interest Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'loan-amount' and 'loan-period' parameters in all versions up to, a…Check if you run itEPSS 0.32%Apr 15, 2026
- High8.8The Login as User plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.3.Check if you run itEPSS 0.41%Apr 15, 2026
- Medium6.1The OPEN-BRAIN plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.0.Check if you run itEPSS 0.22%Apr 15, 2026
- Medium6.4The Power Charts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [pc] shortcode in all versions up to, and including, 0.1.0.Check if you run itEPSS 0.27%Apr 15, 2026
- Medium4.3The Petje.af plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.1.8.Check if you run itEPSS 0.17%Apr 15, 2026
- Medium6.4The WP Circliful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the [circliful] shortcode and via multiple short…Check if you run itEPSS 0.34%Apr 15, 2026
Sort