Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8Improper Privilege ManagementPatch nowKEVEPSS 0.62%Oct 11, 2025
- Medium4.1code-projects Simple Online Hotel Reservation System 1.0 has a Cross Site Scripting (XSS) vulnerability in the Add Room function of the online hotel reservation system.Check this weekEPSS 25.00%Oct 10, 2025
- Medium5.5An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system reCheck this weekEPSS 78.00%Oct 9, 2025
- Critical9.8The Search & Go - Directory WordPress Theme theme for WordPress is vulnerable to Authentication Bypass via account takeover in all versions up to, and including, 2.7.Check this weekEPSS 56.00%Oct 9, 2025
- High8.8The Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme plugin for WordPress is vulnerable to privilege escalation via password update in all versionsCheck this weekEPSS 32.00%Oct 9, 2025
- Medium5.4The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 9.0.46.Check this weekEPSS 19.00%Oct 9, 2025
- UnknownD-Link dir-868l_firmware Cross-Site Request Forgery (CSRF)Patch nowKEVEPSS 0.82%Oct 9, 2025
- Medium5.3The Chartify – WordPress Chart Plugin for WordPress is vulnerable to Missing Authentication for Critical Function in all versions up to, and including, 3.5.9.Check this weekEPSS 41.00%Oct 8, 2025
- High7.2The RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login plugin for WordPress is vulnerable to SQL Injection in all versions up to, and includiCheck this weekEPSS 41.00%Oct 8, 2025
- High7.2An issue in the permission verification module and organization/application editing interface in Casdoor v2.26.0 and before, and fixed in v.2.63.0, allows remote authenticated admiCheck this weekEPSS 66.00%Oct 8, 2025
- High8.8An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter.Check this weekEPSS 98.00%Oct 8, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: md: don't dereference mddev after export_rdev() Except for initial reference, mddev->kobject is referenced by rdCheck this weekEPSS 13.00%Oct 7, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom-adm: fix wrong sizeof config in slave_config Fix broken slave_config function that uncorrectly cCheck this weekEPSS 15.00%Oct 7, 2025
- High8.6The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthCheck if you run itEPSS 4.44%Oct 7, 2025
- Critical9.8Fortinet FortiWeb Path Traversal VulnerabilityPatch nowKEVEPSS 91.97%Oct 6, 2025
- High8.8In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash when I/O abort times out While performing CPU hotplug, a crash with the following stackCheck if you run itEPSS 0.23%Oct 4, 2025
- Medium4.3The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includiCheck this weekEPSS 20.00%Oct 4, 2025
- Critical9.8The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12.Check this weekEPSS 60.00%Oct 4, 2025
- Medium5.1A command injection vulnerability has been reported to affect several QNAP operating system versions.Check if you run itEPSS 1.33%Oct 3, 2025
- Medium4.3The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check this weekEPSS 13.00%Oct 3, 2025
- Medium4.3The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2.Check this weekEPSS 13.00%Oct 3, 2025
- Medium4.3The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.Check this weekEPSS 13.00%Oct 3, 2025
- Medium4.3The ContentMX Content Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6.Check this weekEPSS 17.00%Oct 3, 2025
- Medium4.3The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check this weekEPSS 16.00%Oct 3, 2025
- Medium4.3The Customify theme for WordPress is vulnerable to Cross-Site Request Forgery in version 0.4.11.Check this weekEPSS 20.00%Oct 3, 2025