Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Sermon Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode in all versions up to, and including, 2.30.0.Check if you run itEPSS 0.22%Dec 5, 2025
- Medium6.1The dream gallery plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.14%Dec 5, 2025
- Medium6.1The CoSign Single Signon plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the parameter in all versions up to, and including, 0.3.1 due to insufficient inpuCheck if you run itEPSS 0.25%Dec 5, 2025
- Medium4.3The ContentStudio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.7.Check if you run itEPSS 0.16%Dec 5, 2025
- Critical9.8Array Networks ArrayOS AG OS Command Injection VulnerabilityPatch nowKEVEPSS 3.42%Dec 5, 2025
- Medium4.7The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets.Check if you run itEPSS 0.20%Dec 5, 2025
- Medium4.3In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP isCheck if you run itEPSS 0.12%Dec 5, 2025
- High8.7Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands.Check if you run itEPSS 0.44%Dec 4, 2025
- High7.5Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.Check if you run itEPSS 0.44%Dec 4, 2025
- High7.1Monkeytype is a minimalistic and customizable typing test.Check if you run itEPSS 0.24%Dec 4, 2025
- Medium5.3A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0.Check if you run itEPSS 0.47%Dec 4, 2025
- High7.3SysReptor is a fully customizable pentest reporting platform.Check if you run itEPSS 0.19%Dec 4, 2025
- High8.0Taiko Alethia is an Ethereum-equivalent, permissionless, based rollup designed to scale Ethereum without compromising its fundamental properties.Check if you run itEPSS 0.31%Dec 4, 2025
- High8.9LaraDashboard is an all-In-one solution to start a Laravel Application.Check if you run itEPSS 0.41%Dec 4, 2025
- High7.5Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity.Check if you run itEPSS 0.21%Dec 4, 2025
- Medium6.0When a WF200/WGM160P device is configured to operate as an Access Point, it may be vulnerable to a denial of service triggered by a malformed packet.Check if you run itEPSS 0.17%Dec 4, 2025
- High8.7The password reset mechanism for the Pivot client application is weak, and it may allow an attacker to take over the account.Check if you run itEPSS 0.29%Dec 4, 2025
- High7.4The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to crack the user's domaiCheck if you run itEPSS 0.17%Dec 4, 2025
- High8.3The SolisCloud API suffers from a Broken Access Control vulnerability, specifically an Insecure Direct Object Reference (IDOR), where any authenticated user can access detailed datCheck if you run itEPSS 0.26%Dec 4, 2025
- Low1.8Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.Check if you run itEPSS 0.16%Dec 4, 2025
- High8.7Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.24%Dec 4, 2025
- High8.9Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution.Check if you run itEPSS 1.25%Dec 4, 2025
- Medium5.3TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the endpoint, allowing attackers to steal session cookies and potentially escalate privileges.Check if you run itEPSS 0.24%Dec 4, 2025
- Medium6.9Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint ( ) that exposes sensitive information such as the session key, server version, product details, and diCheck if you run itEPSS 0.30%Dec 4, 2025
- Medium6.9Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary code in the victim'sCheck if you run itEPSS 0.48%Dec 4, 2025
Sort