Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.1Directory traversal vulnerability in SOLIDserver IPAM v8.2.3.Check if you run itEPSS 0.54%Dec 2, 2025
- Medium4.9The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 1.4.6 due to insufficient esc…Check if you run itEPSS 0.31%Dec 2, 2025
- High7.5The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'month' parameter in all versions up to, and i…Check if you run itEPSS 0.33%Dec 2, 2025
- High8.8The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2.Check if you run itEPSS 0.27%Dec 2, 2025
- Medium4.3The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8.Check if you run itEPSS 0.16%Dec 2, 2025
- Medium4.3The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20.Check if you run itEPSS 0.15%Dec 2, 2025
- Medium6.5The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'query' parameter in all versions up to, and includ…Check if you run itEPSS 0.29%Dec 2, 2025
- Medium4.1The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as admin to…Check if you run itEPSS 0.25%Dec 2, 2025
- Medium6.5The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.19.Check if you run itEPSS 0.16%Dec 2, 2025
- High8.8The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() function…Check if you run itEPSS 0.55%Dec 2, 2025
- Critical9.8acfextended advanced_custom_fields_extended Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 67.62%Dec 2, 2025
- High8.7Gin-vue-admin is a backstage management system based on vue and gin.Open the advisoryDec 1, 2025
- Low2.1A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665.Check if you run itEPSS 0.32%Nov 30, 2025
- High8.7OrangeHRM is a comprehensive human resource management (HRM) system.Open the advisoryNov 29, 2025
- UnknownImproper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 76.14%Nov 25, 2025
- UnknownTVT nvms-9000_firmware Missing Authentication for Critical FunctionPatch nowKEVEPSS 0.86%Nov 24, 2025
- Medium6.0An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions,…Open the advisoryNov 18, 2025
- Medium5.4The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a us…Check if you run itEPSS 0.31%Nov 18, 2025
- Medium4.8@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify…Open the advisoryNov 17, 2025
- Low2.1A vulnerability was identified in itsourcecode Inventory Management System 1.0.Check if you run itEPSS 0.35%Nov 16, 2025
- Medium5.5A vulnerability was determined in itsourcecode Inventory Management System 1.0.Check if you run itEPSS 0.42%Nov 16, 2025
- Low2.0A security flaw has been discovered in Bdtask/CodeCanyon News365 up to 7.0.3.Check if you run itEPSS 0.39%Nov 14, 2025
- High8.8A vulnerability in Cisco Catalyst Center Virtual Appliance could allow an authenticated, remote attacker to elevate privileges to Administrator on an affected system.Check if you run itEPSS 0.51%Nov 13, 2025
- Critical9.8pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files.Check this weekEPSS 12.71%Nov 13, 2025
- High8.8The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 3.9.6.Check if you run itEPSS 0.68%Nov 13, 2025