Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.3TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the Boa formWsc hCheck if you run itEPSS 4.36%Dec 3, 2025
- Medium5.4A potential security vulnerability has been identified in HP Image Assistant for versions prior to 5.3.3.Check if you run itEPSS 0.08%Dec 3, 2025
- High7.7An Improper Input Validation vulnerability exists in the user websocket handler of MAAS.Check if you run itEPSS 0.27%Dec 3, 2025
- Medium5.3A vulnerability was identified in ProudMuBai GoFilm 1.0.0/1.0.1.Check if you run itEPSS 0.24%Dec 3, 2025
- Medium6.3A vulnerability was determined in opsre go-ldap-admin up to 20251011.Check if you run itEPSS 0.30%Dec 3, 2025
- Medium4.3The Fluent Booking plugin for WordPress is vulnerable to unauthorized calendar import and management due to a missing capability check on the "importCalendar" function in all versiCheck if you run itEPSS 0.19%Dec 3, 2025
- Medium6.5The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to time-based SQL Injection via the "getTermsForAjax" function in all versionCheck if you run itEPSS 0.34%Dec 3, 2025
- Medium6.4The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficiCheck if you run itEPSS 0.29%Dec 3, 2025
- Medium4.3The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.40.1.Check if you run itEPSS 0.26%Dec 3, 2025
- Medium4.3The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.3.7.2 via thCheck if you run itEPSS 0.24%Dec 3, 2025
- Medium4.3The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5.Check if you run itEPSS 0.12%Dec 3, 2025
- Medium5.4The Post SMTP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.1.Check if you run itEPSS 0.28%Dec 3, 2025
- Medium6.9User enumeration in Nagvis' Checkmk MultisiteAuth before version 1.9.48 allows an unauthenticated attacker to enumerate Checkmk usernames.Check if you run itEPSS 0.26%Dec 3, 2025
- High7.4A flaw was found in WebKitGTK.Check if you run itEPSS 0.33%Dec 3, 2025
- Medium5.3A fix was made in BlazeMeter Jenkins Plugin version 4.27 to allow users only with certain permissions to see the list of available resources like credential IDs, bzm workspaces andCheck if you run itEPSS 0.25%Dec 3, 2025
- High8.8A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell commCheck if you run itEPSS 0.63%Dec 3, 2025
- Medium6.2Protection Mechanism Failure vulnerability in ESTsoft ALZip on Windows allows SmartScreen bypass.This issue affects ALZip: from 12.01 before 12.29.Check if you run itEPSS 0.15%Dec 3, 2025
- Low2.7The Timetable and Event Schedule by MotoPress WordPress plugin before 2.4.16 does not verify a user has access to a specific event when duplicating, leading to arbitrary event discCheck if you run itEPSS 0.21%Dec 3, 2025
- Medium5.3The Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on theCheck if you run itEPSS 0.22%Dec 3, 2025
- Medium5.3The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.5.5 via upload filenames.Check if you run itEPSS 0.33%Dec 3, 2025
- Medium4.9The FluentCart plugin for WordPress is vulnerable to SQL Injection via the 'groupKey' parameter in all versions up to, and including, 1.3.1.Check if you run itEPSS 0.32%Dec 3, 2025
- High7.5The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip_file' function in versions 2.13.1 to 2.Check if you run itEPSS 0.75%Dec 3, 2025
- Medium6.4The CSSIgniter Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' shortcode attribute in all versions up to, and including, 2.4.1 due toCheck if you run itEPSS 0.23%Dec 3, 2025
- High7.2The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax_unzip_file' function in versions 2.13.1Check if you run itEPSS 1.03%Dec 3, 2025
- High7.8WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation.Check if you run itEPSS 0.25%Dec 3, 2025
Sort