Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.4The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input.Check if you run itEPSS 0.67%Feb 19, 2026
- Medium6.4The Dealia – Request a Quote plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Gutenberg block attributes in all versions up to, and including, 1.0.8.Check if you run itEPSS 0.22%Feb 19, 2026
- Medium5.3The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions 4.0 to 5.10 via the 'load_tCheck if you run itEPSS 0.29%Feb 19, 2026
- Medium4.4The Client Testimonial Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Testimonial Heading' setting in all versions up to, and including, 2.0.Check if you run itEPSS 0.22%Feb 19, 2026
- Medium6.5The Simple Membership plugin for WordPress is vulnerable to Improper Handling of Missing Values in all versions up to, and including, 4.7.0 via the Stripe webhook handler.Check if you run itEPSS 0.26%Feb 19, 2026
- High8.1Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability.Check if you run itEPSS 0.46%Feb 19, 2026
- Medium6.3Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect Privilege Assignment vulnerability.Check if you run itEPSS 0.22%Feb 19, 2026
- Medium4.7Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST API.Check if you run itEPSS 0.31%Feb 19, 2026
- Medium4.7Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Improper Verification of Source of a Communication Channel vulnerability in the REST API.Check if you run itEPSS 0.20%Feb 19, 2026
- High8.8Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Missing Authorization vulnerability.Check if you run itEPSS 0.40%Feb 19, 2026
- Medium5.1Reflected Cross-site Scripting (XSS) in Alkacon's OpenCms v18.0, which allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL cCheck if you run itEPSS 0.18%Feb 19, 2026
- Medium5.1Stored Cross-Site Scripting (XSS) in Alkacon's OpenCms v18.0, which occurs when user input is not properly validated when sending a POST request to ‘/blog/new-article/org.opencms.uCheck if you run itEPSS 0.21%Feb 19, 2026
- High8.8Dell Unisphere for PowerMax, version(s) 10.2, contain(s) an External Control of File Name or Path vulnerability.Check if you run itEPSS 0.42%Feb 19, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoDaddy CoBlocks coblocks allows Stored XSS.This issue affects CoBlocks: fromCheck if you run itEPSS 0.15%Feb 19, 2026
- Medium6.5Missing Authorization vulnerability in Greg Winiarski WPAdverts wpadverts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPAdverts: fromCheck if you run itEPSS 0.31%Feb 19, 2026
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in WP Moose Kenta Companion kenta-companion allows Cross Site Request Forgery.This issue affects Kenta Companion: from n/a through <Check if you run itEPSS 0.12%Feb 19, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vaakash Shortcoder shortcoder allows Stored XSS.This issue affects Shortcoder:Check if you run itEPSS 0.15%Feb 19, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Soledad soledad allows DOM-Based XSS.This issue affects Soledad: fCheck if you run itEPSS 0.15%Feb 19, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XSS.This issue affectsCheck if you run itEPSS 0.15%Feb 19, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Podcast penci-podcast allows DOM-Based XSS.This issue affectCheck if you run itEPSS 0.15%Feb 19, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Filter Everything penci-filter-everything allows Stored XSS.Check if you run itEPSS 0.15%Feb 19, 2026
- Medium4.3Missing Authorization vulnerability in PenciDesign Penci AI SmartContent Creator penci-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affectsCheck if you run itEPSS 0.23%Feb 19, 2026
- High7.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in villatheme Sales Countdown Timer for WooCommerce and WordPrCheck if you run itEPSS 0.36%Feb 19, 2026
- Medium5.4Cross-Site Request Forgery (CSRF) vulnerability in ThimPress RealPress realpress allows Cross Site Request Forgery.This issue affects RealPress: from n/a through <= 1.1.0.Check if you run itEPSS 0.11%Feb 19, 2026
- Medium5.3Missing Authorization vulnerability in WPDeveloper NotificationX notificationx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NotificatiCheck if you run itEPSS 0.20%Feb 19, 2026
Sort