Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.8An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event processor admin service.Check if you run itEPSS 0.69%Sep 23, 2025
- Medium6.5In Shenzhen C-Data Technology Co.Check if you run itEPSS 0.14%Sep 23, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Vega WP Frontend Admin display-admin-page-on-frontend allows Stored XSS.TCheck if you run itEPSS 0.28%Sep 22, 2025
- Low1.9A security vulnerability has been detected in htmly up to 3.1.0.Check if you run itEPSS 0.30%Sep 21, 2025
- Medium4.3The Custom Login And Signup Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.13%Sep 20, 2025
- Medium6.1The Browser Sniff plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3.Check if you run itEPSS 0.15%Sep 20, 2025
- Medium6.1The osTicket WP Bridge plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9.2.Check if you run itEPSS 0.15%Sep 20, 2025
- Medium4.3The Internal Links Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.1.Check if you run itEPSS 0.16%Sep 20, 2025
- Medium4.9The ClickWhale – Link Manager, Link Shortener and Click Tracker for Affiliate Links & Link Pages plugin for WordPress is vulnerable to SQL Injection via the export_csv() function iCheck if you run itEPSS 0.30%Sep 20, 2025
- High7.2Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration wh…Check if you run itEPSS 0.64%Sep 19, 2025
- High8.5Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 25.1.102 and Application versions prior to 25.1.1413 (macOS/Linux client deployments) are vulnerable tCheck if you run itEPSS 0.44%Sep 19, 2025
- Critical9.3Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.843 and Application prior to 20.0.1923 (VA and SaaS deployments) contains dangerous PHP dead codeCheck if you run itEPSS 1.41%Sep 19, 2025
- High8.6Vasion Print (formerly PrinterLogic) Virtual Appliance Host versions prior to 22.0.951, Application prior to 20.0.2368 (VA and SaaS deployments) contain an undocumented local userCheck if you run itEPSS 0.28%Sep 19, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: ice: fix NULL access of tx->in_use in ice_ptp_ts_irq The E810 device has support for a "low latency" firmware inCheck if you run itEPSS 0.17%Sep 19, 2025
- Critical9.8The Service Finder Bookings plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.0.Check if you run itEPSS 0.42%Sep 19, 2025
- Low1.8SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys under certain conditions, allowing unauthorized privilege escalCheck if you run itEPSS 0.12%Sep 18, 2025
- Low2.0A vulnerability has been found in SeaCMS up to 13.3.Check if you run itEPSS 0.41%Sep 18, 2025
- Medium6.7NVIDIA HGX & DGX GB200, GB300, B300 contain a vulnerability in the HGX Management Controller (HMC) that may allow a malicious actor with administrative access on the BMC to accessCheck if you run itEPSS 0.15%Sep 17, 2025
- High7.7Dragonfly is an open source P2P-based file distribution and image acceleration system.Check this weekEPSS 38.00%Sep 17, 2025
- Medium5.4The The Hack Repair Guy's Plugin Archiver plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4.Check if you run itEPSS 0.13%Sep 17, 2025
- Medium4.3The User Sync – Remote User Sync plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2.Check if you run itEPSS 0.20%Sep 17, 2025
- Medium4.3The USS Upyun plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5.0.Check if you run itEPSS 0.17%Sep 17, 2025
- Medium6.6The Developer Loggers for Simple History plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.5 via the enabled_loggers parameter.Check if you run itEPSS 0.80%Sep 17, 2025
- High8.0In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail.Check if you run itEPSS 1.16%Sep 17, 2025
- Critical9.3osCommerce versions up to and including 2.2 RC2a contain a vulnerability in its administrative file manager utility (admin/file_manager.php).Check if you run itEPSS 1.60%Sep 16, 2025