Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.8The Bluetooth Mesh Access-layer delayable message queue in subsys/bluetooth/mesh/delayable_msg.c shares three intrusive lists (busy_ctx, free_ctx, free_chunks) and one…Check if you run itEPSS 0.14%Oct 13, 2026
- Medium5.3IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication.Check if you run itEPSS 0.28%Oct 13, 2026
- Unknownfetchmail-6.6.8-1.1 on GA mediaOpen the advisoryOct 13, 2026
- UnknownMalicious code in monkey-tags-ip (npm)Open the advisoryOct 13, 2026
- UnknownMalicious code in @user-interface-common/common-styles (npm)Open the advisoryOct 13, 2026
- UnknownMalicious code in @newspage/libx-amount (npm)Open the advisoryOct 13, 2026
- UnknownMalicious code in @newspage/lib-ng-async-routes-ui (npm)Open the advisoryOct 13, 2026
- UnknownMalicious code in @mntv-analysis/workspaces-components (npm)Open the advisoryOct 13, 2026
- UnknownMalicious code in @mntv-analysis/ui-components (npm)Open the advisoryOct 13, 2026
- UnknownMalicious code in @mntv-analysis/ui (npm)Open the advisoryOct 13, 2026
- MediumThe GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, a…Check if you run itEPSS 0.21%Oct 13, 2026
- MediumThe Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all version…Check if you run itEPSS 0.20%Oct 13, 2026
- MediumThe SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the get_instance_css function.Check if you run itEPSS 0.73%Oct 13, 2026
- MediumThe Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link…Check if you run itEPSS 0.16%Oct 13, 2026
- High8.7The network messaging layer contained improper handling of highly compressed data affecting service availability.Check if you run itEPSS 0.36%Oct 13, 2026
- High7.1QAPI contained a stack-based buffer overflow affecting service availability.Check if you run itEPSS 0.24%Oct 13, 2026
- High7.5Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service VulnerabilityCheck if you run itEPSS 0.75%Oct 13, 2026
- High8.8Microsoft Windows Command Injection VulnerabilityPatch nowKEVEPSS 1.51%Oct 13, 2026
- HighThe WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter…Check if you run itEPSS 0.32%Oct 13, 2026
- MediumGitea private repository access retained after rejected transferCheck if you run itEPSS 0.21%Oct 13, 2026
- HighThe Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions'…Check if you run itEPSS 0.24%Oct 13, 2026
- Medium5.1Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL.Check this weekEPSS 23.00%Oct 13, 2026
- HighWhen Gitea's web installer is reachable against a database that already contains users, such as after has been reset to , submitting the install form with an administr…Check if you run itEPSS 0.44%Oct 13, 2026
- MediumGitea migration SSRF to reserved addresses through ALLOWED_DOMAINSCheck if you run itEPSS 0.20%Oct 13, 2026
- HighA repository's external issue tracker regular expression containing alternating capture groups could produce invalid slice indexes when Gitea rendered issue references…Check if you run itEPSS 0.35%Oct 13, 2026