Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Display During Conditional Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 1.2 dueCheck if you run itEPSS 0.26%Feb 18, 2026
- Medium4.4The WP 404 Auto Redirect to Similar Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.5 due to insCheck if you run itEPSS 0.22%Feb 18, 2026
- High7.2The Rent Fetch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'keyword' parameter in all versions up to, and including, 0.32.4 due to insufficient inputCheck if you run itEPSS 0.35%Feb 18, 2026
- Medium6.1The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Open Redirection in all versions up to, and including, 1.2.7 due to insufficient validation on the 'Check if you run itEPSS 0.52%Feb 18, 2026
- Medium4.3The Order Splitter for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wos_troubleshooting' AJAX endpoint inCheck if you run itEPSS 0.25%Feb 18, 2026
- Medium6.4The Filestack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'filepicker' shortcode in all versions up to, and including, 2.0.8 due to insufficiCheck if you run itEPSS 0.21%Feb 18, 2026
- Medium4.3The Frontend User Notes plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'funp_ajax_modify_notes' AJAX endCheck if you run itEPSS 0.18%Feb 18, 2026
- Medium5.3The Context Blog theme for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.2.5 via the 'context_blog_modal_popup' due to insufficient restriCheck if you run itEPSS 0.38%Feb 18, 2026
- Low2.9zlib before 1.3.2 allows CPU consumption via crc32_combine64 and crc32_combine_gen64 because x2nmodp can do right shifts within a loop that has no termination condition.Check if you run itEPSS 0.25%Feb 18, 2026
- High8.2An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1.Check if you run itEPSS 0.42%Feb 18, 2026
- Unknownmcpjam inspector Missing Authentication for Critical FunctionPatch nowKEVEPSS 67.52%Feb 18, 2026
- High7.2Missing AuthorizationPatch nowKEVEPSS 0.46%Feb 18, 2026
- Critical9.8UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote attacker to gain rooCheck if you run itEPSS 0.49%Feb 18, 2026
- Critical9.8code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /admin/update_user.php.Check if you run itEPSS 0.50%Feb 18, 2026
- High8.8code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload.Check if you run itEPSS 0.79%Feb 18, 2026
- Critical9.8CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delete arbitrary member reCheck if you run itEPSS 0.74%Feb 18, 2026
- Critical9.8CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter.Check if you run itEPSS 0.44%Feb 18, 2026
- High7.5Missing authentication and authorization in print_membership_card.php in CodeAstro Membership Management System 1.0 allows unauthenticated attackers to access membership card dataCheck if you run itEPSS 0.49%Feb 18, 2026
- High7.5Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitive information (includCheck if you run itEPSS 0.58%Feb 18, 2026
- Critical9.1Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perform unauthorized admiCheck if you run itEPSS 0.64%Feb 18, 2026
- Critical9.4SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php.Check if you run itEPSS 0.77%Feb 18, 2026
- High8.8PHPGurukul Hospital Management System v4.0 contains a Privilege Escalation vulnerability.Check if you run itEPSS 0.54%Feb 18, 2026
- Medium6.5The 'Medical History' module in PHPGurukul Hospital Management System v4.0 contains an Insecure Direct Object Reference (IDOR) vulnerability.Check if you run itEPSS 0.38%Feb 18, 2026
- Medium6.5PHPGurukul Hospital Management System v4.0 contains a Cross-Site Request Forgery (CSRF) vulnerability in the 'Add Doctor' module.Check if you run itEPSS 0.20%Feb 18, 2026
- Critical9.8ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php.Check if you run itEPSS 1.82%Feb 18, 2026
Sort