Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.8ZDI-26-782: LibreOffice PDF File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityCheck if you run itEPSS 0.19%Oct 16, 2026
- High7.8ZDI-26-783: LibreOffice PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityCheck if you run itEPSS 0.12%Oct 16, 2026
- High7.8ZDI-26-781: LibreOffice EMF+ Brush Integer Overflow Remote Code Execution VulnerabilityCheck if you run itEPSS 0.17%Oct 16, 2026
- High7.8ZDI-26-785: FreeBSD Kernel Shared Memory Time-Of-Check Time-Of-Use Local Privilege Escalation VulnerabilityCheck if you run itEPSS 0.12%Oct 16, 2026
- High8.8ZDI-26-784: FreeBSD Kernel kqueue Use-After-Free Local Privilege Escalation VulnerabilityCheck if you run itEPSS 0.10%Oct 16, 2026
- High8.0The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in al…Check if you run itEPSS 0.34%Oct 16, 2026
- Medium6.4The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attri…Check if you run itEPSS 0.16%Oct 16, 2026
- Medium4.3The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Ref…Check if you run itEPSS 0.21%Oct 16, 2026
- Medium6.4The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and includ…Check if you run itEPSS 0.24%Oct 16, 2026
- High7.8Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents.Check if you run itEPSS 0.14%Oct 16, 2026
- Medium5.9Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application.Check if you run itEPSS 0.14%Oct 16, 2026
- Medium5.9Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default).Check if you run itEPSS 0.21%Oct 16, 2026
- Low3.7Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems.Check if you run itEPSS 0.21%Oct 16, 2026
- High8.1Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved.Check if you run itEPSS 0.28%Oct 16, 2026
- High8.6Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development.Check if you run itEPSS 0.26%Oct 16, 2026
- High8.1Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=).Check if you run itEPSS 0.28%Oct 16, 2026
- Critical9.8Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to i…Check if you run itEPSS 0.26%Oct 16, 2026
- Medium6.5Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-…Check if you run itEPSS 0.16%Oct 16, 2026
- Medium5.3Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags.Check if you run itEPSS 0.23%Oct 16, 2026
- High7.2The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter…Check if you run itEPSS 0.33%Oct 16, 2026
- High7.2The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…Check if you run itEPSS 0.31%Oct 16, 2026
- High7.2The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 du…Check if you run itEPSS 0.36%Oct 16, 2026
- Medium5.9The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter.Check if you run itEPSS 0.77%Oct 16, 2026
- High8.1The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the parameter in versions up to, and including, 3.3.0.Check if you run itEPSS 0.52%Oct 16, 2026
- Medium4.9The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].Check if you run itEPSS 0.38%Oct 16, 2026