Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.8Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBusOpen the advisoryOct 16, 2026
- High8.7libp2p-rust is the official Rust language implementation of the libp2p networking stack.Open the advisoryOct 16, 2026
- High7.2SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families.Open the advisoryOct 16, 2026
- Medium5.4MariaDB server is a community developed fork of MySQL server.Check if you run itEPSS 0.22%Oct 16, 2026
- High7.5pupnp is an SDK for development of UPnP device and control point applications.Open the advisoryOct 16, 2026
- High7.1pupnp is an SDK for development of UPnP device and control point applications.Check if you run itEPSS 0.32%Oct 16, 2026
- High7.5pupnp is an SDK for development of UPnP device and control point applications.Open the advisoryOct 16, 2026
- High7.5libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session.Open the advisoryOct 16, 2026
- Critical9.0countly-server is the server-side part of Countly, a product analytics solution.Check this weekEPSS 34.00%Oct 16, 2026
- High8.8An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.Open the advisoryOct 16, 2026
- Medium5.3A flaw was found in libtirpc.Check if you run itEPSS 0.23%Oct 16, 2026
- Medium4.3Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' ParameterCheck if you run itEPSS 0.20%Oct 16, 2026
- Medium6.4xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' ParameterCheck if you run itEPSS 0.20%Oct 16, 2026
- Medium4.9Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' ParameterCheck if you run itEPSS 0.77%Oct 16, 2026
- High8.1User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart TagCheck if you run itEPSS 0.37%Oct 16, 2026
- Medium4.3User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()Check if you run itEPSS 0.15%Oct 16, 2026
- High7.2User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field ValueCheck if you run itEPSS 0.23%Oct 16, 2026
- Medium6.8WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce ReuseCheck if you run itEPSS 0.26%Oct 16, 2026
- Medium6.5WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX actionCheck if you run itEPSS 0.26%Oct 16, 2026
- High7.5WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' ActionCheck if you run itEPSS 0.32%Oct 16, 2026
- High7.2EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' ParameterCheck if you run itEPSS 0.24%Oct 16, 2026
- Medium6.4Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' ParameterCheck if you run itEPSS 0.19%Oct 16, 2026
- Medium6.4Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode AttributeCheck if you run itEPSS 0.19%Oct 16, 2026
- Medium4.9Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' CookieCheck if you run itEPSS 0.30%Oct 16, 2026
- Medium6.5LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX ActionCheck if you run itEPSS 0.25%Oct 16, 2026