Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The WM JqMath plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style' shortcode attribute of the [jqmath] shortcode in all versions up to and including 1.Check if you run itEPSS 0.27%Apr 15, 2026
- Medium5.3The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3.9.7 This is due to the payment integrations (Stripe/PayPal)Check if you run itEPSS 0.28%Apr 15, 2026
- Medium6.4The Coachific Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userhash' shortcode attribute in all versions up to and including 1.0.Check if you run itEPSS 0.30%Apr 15, 2026
- Medium5.3The e-shot™ form builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.2.Check if you run itEPSS 0.38%Apr 15, 2026
- High7.1A Stored Cross-Site Scripting vulnerability was discovered in the Assets and Nodes functionality due to improper validation of an input parameter.Check if you run itEPSS 0.30%Apr 15, 2026
- High7.2An access control vulnerability was discovered in the Threat Intelligence functionality due to a specific access restriction not being properly enforced for users with view-only prCheck if you run itEPSS 0.34%Apr 15, 2026
- High7.5Apache::API::Password versions through 0.5.2 for Perl can generate insecure random values for salts.Check if you run itEPSS 0.58%Apr 15, 2026
- High7.5Deadwood in MaraDNS 3.5.0036 allows attackers to exhaust connection slots via a zone whose authoritative nameserver address cannot be resolved.Check if you run itEPSS 0.38%Apr 15, 2026
- Medium4.3The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in version 1.0.Check if you run itEPSS 0.22%Apr 15, 2026
- High7.8It has been identified that a vulnerability (CWE-427) exists in the UPS (Uninterruptible Power Supply) management application, whereby improper permissions on the inst…Check if you run itEPSS 0.13%Apr 15, 2026
- Medium4.8Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier.Check if you run itEPSS 0.19%Apr 15, 2026
- Medium5.1Versions of the package github.com/yuin/goldmark/renderer/html before 1.7.17 are vulnerable to Cross-site Scripting (XSS) due to improper ordering of URL validation and normalizatiCheck if you run itEPSS 0.29%Apr 15, 2026
- High8.3Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation, packet p…Check if you run itEPSS 0.19%Apr 15, 2026
- Medium5.3The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0.Check if you run itEPSS 0.93%Apr 15, 2026
- Medium6.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.Check if you run itEPSS 0.55%Apr 15, 2026
- Medium6.9XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it.Check if you run itEPSS 0.41%Apr 15, 2026
- Medium4.4SpiceDB is an open source database system for creating and managing security-critical application permissions.Check if you run itEPSS 0.17%Apr 15, 2026
- Medium5.5Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.Check if you run itEPSS 0.10%Apr 15, 2026
- Medium6.9Serendipity is a PHP-powered weblog engine.Check if you run itEPSS 0.23%Apr 15, 2026
- High7.2The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ parameter in all…Check if you run itEPSS 0.34%Apr 15, 2026
- Critical9.8The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and…Check if you run itEPSS 1.00%Apr 15, 2026
- Medium4.3The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1.Check if you run itEPSS 0.29%Apr 15, 2026
- Medium5.4The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1.Check if you run itEPSS 0.32%Apr 15, 2026
- High8.4radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embeddinCheck if you run itEPSS 1.21%Apr 15, 2026
- High8.1Withdrawn Advisory: Apache Airflow: RCE by race condition in example_xcom dagCheck if you run itEPSS 0.59%Apr 15, 2026
Sort