Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL EndpointOpen the advisoryOct 17, 2026
- Medium6.0Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPCOpen the advisoryOct 17, 2026
- Medium5.3Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC PolicyOpen the advisoryOct 17, 2026
- High8.7Coder before 2.35.4 Credential Theft via Workspace Proxy Hostname Prefix MatchOpen the advisoryOct 17, 2026
- Critical9.3phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challeCheck if you run itEPSS 0.00%Oct 17, 2026
- High7.1WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerabilityOpen the advisoryOct 17, 2026
- Medium5.0The WP Data Access WordPress plugin before 5.5.88 does not have authorisation and CSRF checks in one of its actions, allowing any authenticated user, such as a subscri…Open the advisoryOct 17, 2026
- Medium5.9The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing…Open the advisoryOct 17, 2026
- Medium6.8The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and…Open the advisoryOct 17, 2026
- Medium5.3The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net, NMI) WordPress plugin before 1.120.70 does not perform any…Open the advisoryOct 17, 2026
- Medium6.5The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthen…Check if you run itEPSS 0.14%Oct 17, 2026
- Medium6.5The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator…Check if you run itEPSS 0.11%Oct 17, 2026
- Medium4.3The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting, allowing unauthenticated attackers to redirect vi…Check if you run itEPSS 0.14%Oct 17, 2026
- Low3.7The Patreon WordPress plugin before 1.10.0 does not perform an authorization check on some of its functionality, allowing unauthenticated users to enumerate the names…Check if you run itEPSS 0.14%Oct 17, 2026
- Medium6.8The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticate…Check if you run itEPSS 0.16%Oct 17, 2026
- Medium6.6The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content…Check if you run itEPSS 0.20%Oct 17, 2026
- Medium5.3The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitte…Check if you run itEPSS 0.13%Oct 17, 2026
- High7.5An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.Check if you run itEPSS 0.49%Oct 17, 2026
- High8.1An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.Check if you run itEPSS 0.39%Oct 17, 2026
- High7.5Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affe…Open the advisoryOct 17, 2026
- Medium5.3The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment st…Check if you run itEPSS 0.14%Oct 17, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments…Check if you run itEPSS 0.19%Oct 17, 2026
- High8.1OpenHuman is an open-source agent harness available as a desktop application and Rust library.Open the advisoryOct 16, 2026
- High7.1Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering.Open the advisoryOct 16, 2026
- Critical9.8Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parseCheck if you run itEPSS 0.19%Oct 16, 2026