Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low3.7Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' ParameterCheck if you run itEPSS 0.29%Oct 16, 2026
- High7.2LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' ParametersCheck if you run itEPSS 0.29%Oct 16, 2026
- High7.5Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' ParameterCheck if you run itEPSS 0.40%Oct 16, 2026
- Critical9.1Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts CounterCheck if you run itEPSS 0.40%Oct 16, 2026
- Medium6.1Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' ParameterCheck if you run itEPSS 0.23%Oct 16, 2026
- High7.2Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template ImportCheck if you run itEPSS 0.47%Oct 16, 2026
- Critical9.6An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header iCheck this weekEPSS 29.00%Oct 16, 2026
- Critical9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin.Open the advisoryOct 16, 2026
- Critical9.8Deserialization of Untrusted Data vulnerability in Apache Kylin.Open the advisoryOct 16, 2026
- Critical9.1Missing Authorization vulnerability in Apache Kylin.Open the advisoryOct 16, 2026
- Medium6.0Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the l…Open the advisoryOct 16, 2026
- Medium6.6A flaw was found in Nautilus.Check if you run itEPSS 0.13%Oct 16, 2026
- High7.1Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow.Check if you run itEPSS 0.21%Oct 16, 2026
- Medium5.3Active debug code vulnerability in SFM Software Technologies Inc.Check if you run itEPSS 0.20%Oct 16, 2026
- Medium6.5Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc.Check if you run itEPSS 0.19%Oct 16, 2026
- Critical9.3An SQL injection vulnerability has been discovered in TSG Profleet.Check if you run itEPSS 0.23%Oct 16, 2026
- Medium6.5Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadca…Check if you run itEPSS 0.25%Oct 16, 2026
- Medium4.5Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log…Check if you run itEPSS 0.24%Oct 16, 2026
- Medium4.4Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpo…Check if you run itEPSS 0.20%Oct 16, 2026
- Medium4.3Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-init…Check if you run itEPSS 0.15%Oct 16, 2026
- Medium4.3Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows…Check if you run itEPSS 0.18%Oct 16, 2026
- Medium4.3Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, w…Check if you run itEPSS 0.16%Oct 16, 2026
- Medium5.0Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team…Check if you run itEPSS 0.16%Oct 16, 2026
- High7.1Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which a…Check if you run itEPSS 0.19%Oct 16, 2026
- Medium6.5Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during…Check if you run itEPSS 0.28%Oct 16, 2026