Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8The LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress is vulnerable to privilege escalation.Check if you run itEPSS 0.35%Nov 13, 2025
- Low1.2Frappe Learning is a learning system that helps users structure their content.Open the advisoryNov 12, 2025
- Low2.0A flaw has been found in code-projects Responsive Hotel Site 1.0.Check if you run itEPSS 0.41%Nov 12, 2025
- Low2.0A vulnerability was detected in code-projects Responsive Hotel Site 1.0.Check if you run itEPSS 0.41%Nov 12, 2025
- Low3.5In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a…Check if you run itEPSS 0.30%Nov 12, 2025
- High7.3CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin us…Check if you run itEPSS 0.14%Nov 12, 2025
- Medium4.3The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information due to a missing authorizati…Check if you run itEPSS 0.28%Nov 12, 2025
- Critical9.3The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to craft administrator access tokens and use them t…Check if you run itEPSS 0.62%Nov 12, 2025
- Critical9.3The a+HRD developed by aEnrich has an Authentication Abuse vulnerability, allowing unauthenticated remote attackers to send crafted packets to obtain administrator acc…Check if you run itEPSS 0.69%Nov 12, 2025
- Medium4.8The a+HRD developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing remote attackers with administrator privileges to inject persistent JavaScript…Check if you run itEPSS 0.23%Nov 12, 2025
- Medium4.4The MembershipWorks – Membership, Events & Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and in…Check if you run itEPSS 0.25%Nov 12, 2025
- Unknownsecurenvoy multi-factor_authentication_solutions Cleartext Transmission of Sensitive InformationPatch nowKEVEPSS 3.30%Nov 12, 2025
- Unknowncontrolid idsecure Improper AuthenticationPatch nowKEVEPSS 65.00%Nov 10, 2025
- UnknownImproper Neutralization of Special Elements used in a Command ('Command Injection')Patch nowKEVEPSS 1.54%Nov 7, 2025
- High8.6Sangoma FreePBX OS Command Injection VulnerabilityPatch nowKEVEPSS 84.62%Nov 6, 2025
- Unknownmeowapps ai_engine Exposure of Sensitive Information to an Unauthorized ActorPatch nowKEVEPSS 74.66%Nov 5, 2025
- UnknownImproper Privilege ManagementPatch nowKEVEPSS 9.61%Oct 31, 2025
- Unknownnootheme jobmonster Authentication Bypass Using an Alternate Path or ChannelPatch nowKEVEPSS 0.80%Oct 31, 2025
- UnknownJEECG jeecg Incorrect Permission Assignment for Critical ResourcePatch nowKEVEPSS 3.52%Oct 31, 2025
- Unknownkubernetes operations Missing Authentication for Critical FunctionPatch nowKEVEPSS 0.40%Oct 30, 2025
- Unknownrapid7 velociraptor Incorrect Default PermissionsPatch nowKEVEPSS 1.02%Oct 22, 2025
- Unknownthimpress learnpress Missing AuthorizationPatch nowKEVEPSS 0.46%Oct 18, 2025
- UnknownFortra filecatalyst_workflow Improper Input ValidationPatch nowKEVEPSS 90.07%Oct 17, 2025
- UnknownCisco smart_software_manager_on-prem Unverified Password ChangePatch nowKEVEPSS 80.64%Oct 17, 2025
- UnknownZyxel usg40_firmware Improper AuthenticationPatch nowKEVEPSS 95.13%Oct 17, 2025