Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8An OS Command Injection vulnerability in the Admin panel in Curo UC300 5.42.1.7.1.63R1 allows local attackers to inject arbitrary OS Commands via the "IP Addr" parameter.Check this weekEPSS 98.00%Oct 8, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: md: don't dereference mddev after export_rdev() Except for initial reference, mddev->kobject is referenced by rdCheck this weekEPSS 13.00%Oct 7, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: dmaengine: qcom-adm: fix wrong sizeof config in slave_config Fix broken slave_config function that uncorrectly cCheck this weekEPSS 15.00%Oct 7, 2025
- High8.6The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthCheck if you run itEPSS 4.44%Oct 7, 2025
- Critical9.8Fortinet FortiWeb Path Traversal VulnerabilityPatch nowKEVEPSS 91.97%Oct 6, 2025
- High8.8In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix crash when I/O abort times out While performing CPU hotplug, a crash with the following stackCheck if you run itEPSS 0.23%Oct 4, 2025
- Medium4.3The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includiCheck this weekEPSS 20.00%Oct 4, 2025
- Critical9.8The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and including, 6.26.12.Check this weekEPSS 60.00%Oct 4, 2025
- Medium5.1A command injection vulnerability has been reported to affect several QNAP operating system versions.Check if you run itEPSS 1.33%Oct 3, 2025
- Medium4.3The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check this weekEPSS 13.00%Oct 3, 2025
- Medium4.3The AP Background plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.2.Check this weekEPSS 13.00%Oct 3, 2025
- Medium4.3The Notification Bar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.Check this weekEPSS 13.00%Oct 3, 2025
- Medium4.3The ContentMX Content Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6.Check this weekEPSS 17.00%Oct 3, 2025
- Medium4.3The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check this weekEPSS 16.00%Oct 3, 2025
- Medium4.3The Customify theme for WordPress is vulnerable to Cross-Site Request Forgery in version 0.4.11.Check this weekEPSS 20.00%Oct 3, 2025
- Medium5.3The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1.Check this weekEPSS 15.00%Oct 3, 2025
- Medium4.3The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3.Check this weekEPSS 15.00%Oct 3, 2025
- Medium4.4The TableGen – Data Table Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.1 due to insufficCheck this weekEPSS 24.00%Oct 3, 2025
- Medium4.3The Optimize More! – CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3.Check this weekEPSS 14.00%Oct 3, 2025
- Low3.8The Backup Bolt plugin for WordPress is vulnerable to arbitrary file downloads and backup location writes in all versions up to, and including, 1.4.1 via the process_backup_batch()Check this weekEPSS 31.00%Oct 3, 2025
- Medium6.1The Mobile Site Redirect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1.Check this weekEPSS 16.00%Oct 3, 2025
- Medium5.5The Interactive Human Anatomy with Clickable Body Parts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2Check this weekEPSS 22.00%Oct 3, 2025
- Critical9.8The Appy Pie Connect for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within the reset_user_password() REST handler in all veCheck this weekEPSS 47.00%Oct 3, 2025
- Medium4.3The MPWizard – Create Mercado Pago Payment Links plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1.Check this weekEPSS 13.00%Oct 3, 2025
- Medium5.5The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insufficient input sanitizatiCheck this weekEPSS 22.00%Oct 3, 2025