Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.2The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including,…Check if you run itEPSS 0.31%Oct 14, 2026
- MediumCVE-2026-98430: RDMA/efa: Keep admin queues alive while IRQ is registeredCheck if you run itEPSS 0.21%Oct 14, 2026
- UnknownCisco UCS and UCS-Based Appliances UEFI Shell Secure Boot Bypass VulnerabilityCheck if you run itEPSS 0.16%Oct 13, 2026
- Critical9.8Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_valuePatch nowKEVEPSS 0.45%Oct 13, 2026
- Critical9.8Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' ParameterCheck if you run itEPSS 0.38%Oct 13, 2026
- High8.6Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their autho…Check if you run itEPSS 0.25%Oct 13, 2026
- High7.1Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invok…Check if you run itEPSS 0.21%Oct 13, 2026
- Critical9.1Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authent…Check if you run itEPSS 0.41%Oct 13, 2026
- High8.7Omnispace Agora Project before 26.10.0 contains a SQL identifier injection vulnerability that allows a space administrator to escalate privileges by supplying caller-c…Check if you run itEPSS 0.43%Oct 13, 2026
- High7.2The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6.Check if you run itEPSS 0.31%Oct 13, 2026
- Low2.1Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound model values as raw HTML with…Check if you run itEPSS 0.24%Oct 13, 2026
- High8.7Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify…Check if you run itEPSS 0.46%Oct 13, 2026
- Medium5.3QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slip…Check if you run itEPSS 0.26%Oct 13, 2026
- High7.1Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other operators' BCrypt password hashe…Check if you run itEPSS 0.50%Oct 13, 2026
- High8.7Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration…Check if you run itEPSS 0.45%Oct 13, 2026
- Critical10.0Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js…Check if you run itEPSS 0.56%Oct 13, 2026
- Medium4.3Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator.Check if you run itEPSS 0.23%Oct 13, 2026
- High7.5The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 20260828.Check if you run itEPSS 0.34%Oct 13, 2026
- High7.5The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execu…Check if you run itEPSS 0.54%Oct 13, 2026
- UnknownCitrix security advisory (AV26-1034)Open the advisoryOct 13, 2026
- Medium5.5A flaw was found in BusyBox's mount utility.Check if you run itEPSS 0.11%Oct 13, 2026
- Critical9.8A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions.Check if you run itEPSS 0.33%Oct 13, 2026
- High8.6MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/a…Check if you run itEPSS 0.30%Oct 13, 2026
- Medium5.1bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content…Check if you run itEPSS 0.23%Oct 13, 2026
- High8.6Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token.Check if you run itEPSS 0.43%Oct 13, 2026