Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.Check if you run itEPSS 1.18%May 5, 2025
- Medium6.5NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function.Check if you run itEPSS 1.18%May 5, 2025
- Medium6.5IBM Cloud Pak for Business Automation 24.0.0 and 24.0.1 through 24.0.1 IF001 Authoring allows an authenticated user to bypass client-side data validation in an authoring user interCheck if you run itEPSS 0.41%May 3, 2025
- Medium6.1The Abundatrade Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.02.Check if you run itEPSS 0.18%May 3, 2025
- Medium6.1The Alink Tap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.1.Check if you run itEPSS 0.18%May 3, 2025
- Critical9.8The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the register_action() function in versions 0.1 to 0.1.1.Check if you run itEPSS 0.57%May 3, 2025
- Medium6.1The Advanced Reorder Image Text Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.18%May 3, 2025
- Medium6.5The FULL – Cliente plugin for WordPress is vulnerable to SQL Injection via the 'formId' parameter in all versions 3.1.5 to 3.1.25 due to insufficient escaping on the user suppliedCheck if you run itEPSS 0.39%May 2, 2025
- Medium6.4The KiwiChat NextClient plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 6.2 due to insufficient inpuCheck if you run itEPSS 0.30%May 2, 2025
- Medium6.5IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, and MQ Operator SC2 3.2.0 through 3.2.10 Client conneCheck if you run itEPSS 0.39%May 1, 2025
- High8.5KUNBUS PiCtory version 2.11.1 and earlier are vulnerable when an authenticated remote attacker crafts a special filename that can be stored by API endpoints.Check this weekEPSS 19.45%May 1, 2025
- High7.5In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed There is a null-ptr-deref when xps sysfs alloc failed: BUCheck if you run itEPSS 0.36%May 1, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: fix potential memleak in 'add_widget_node' As 'kobject_add' may allocated memory for 'kobject->name'Check if you run itEPSS 0.20%May 1, 2025
- High7.5In the Linux kernel, the following vulnerability has been resolved: 9p: trans_fd/p9_conn_cancel: drop client lock earlier syzbot reported a double-lock here and we no longer need tCheck if you run itEPSS 0.39%May 1, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: net/9p: use a dedicated spinlock for trans_fd Shamelessly copying the explanation from Tetsuo Handa's suggestedCheck if you run itEPSS 0.15%May 1, 2025
- Critical9.8In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in decryption with multichannel After commit f7025d861694 ("smb: client: allocate crypto onCheck if you run itEPSS 0.38%May 1, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queue_buf A client driver may use mhi_unprepare_from_transfer() tCheck if you run itEPSS 0.15%May 1, 2025
- High7.5In the Linux kernel, the following vulnerability has been resolved: mptcp: fix NULL pointer in can_accept_new_subflow When testing valkey benchmark tool with MPTCP, the kernel paniCheck if you run itEPSS 0.58%May 1, 2025
- Medium4.3The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for WordPress is vulnerabCheck if you run itEPSS 0.20%May 1, 2025
- High8.8The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4.Check if you run itEPSS 0.39%May 1, 2025
- Medium6.0The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirect_uri was on theCheck if you run itEPSS 0.32%May 1, 2025
- High8.2Cleartext transmission of sensitive information in the web management portal of the Tenda RX2 Pro 16.03.30.14 allows an attacker to decrypt traffic between the client and server byCheck if you run itEPSS 0.26%May 1, 2025
- Medium6.5Initialization vector (IV) reuse in the web management portal of the Tenda RX2 Pro 16.03.30.14 may allow an attacker to discern information about or more easily decrypt encrypted mCheck if you run itEPSS 0.32%May 1, 2025
- Medium6.5Multiple vectors in HCL Domino Volt and Domino Leap allow client-side script injection in the authoring environment and deployed applications.Check if you run itEPSS 0.26%Apr 30, 2025
- Medium6.3Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.Check if you run itEPSS 0.25%Apr 30, 2025