Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3The Simple calendar for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.6.6.Check if you run itEPSS 0.37%Jan 28, 2026
- High7.3The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple REST API endpoints inCheck if you run itEPSS 0.35%Jan 28, 2026
- Medium6.4The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_simple_folio_item_client_name' and '_simple_folio_item_link' meta fields in all versionCheck if you run itEPSS 0.30%Jan 28, 2026
- Medium6.4The Buy Now Plus – Buy Now buttons for Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buynowplus' shortcode in all versions up to, and including,Check if you run itEPSS 0.29%Jan 28, 2026
- Medium5.3The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionalitCheck if you run itEPSS 0.44%Jan 28, 2026
- Medium6.4The Forms Bridge – Infinite integrations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute in the 'financoop_campaign' shortcode inCheck if you run itEPSS 0.27%Jan 28, 2026
- Medium6.1Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scripting.Check if you run itEPSS 0.32%Jan 28, 2026
- High7.2The TableMaster for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.6.Check if you run itEPSS 0.32%Jan 28, 2026
- Medium4.3The Easy Replace Image plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.5.2.Check if you run itEPSS 0.28%Jan 28, 2026
- Medium6.4The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder_img’ parameter in all versions up to, and including, 3.8.8 dueCheck if you run itEPSS 0.27%Jan 28, 2026
- High8.6A vulnerability was determined in D-Link DIR-615 4.10.Check if you run itEPSS 5.57%Jan 28, 2026
- High8.6A vulnerability was found in D-Link DIR-615 4.10.Check if you run itEPSS 5.07%Jan 28, 2026
- Medium6.1billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.Check if you run itEPSS 0.21%Jan 28, 2026
- Critical9.8SolarWinds Web Help Desk Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 84.18%Jan 28, 2026
- Critical9.8SolarWinds Web Help Desk Security Control Bypass VulnerabilityPatch nowKEVEPSS 73.56%Jan 28, 2026
- Medium6.5A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.Check if you run itEPSS 0.34%Jan 28, 2026
- High7.5An issue in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.Check if you run itEPSS 0.36%Jan 28, 2026
- High7.5A GPU device-ID validation flaw in the flow.cuda.get_device_capability() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted device ID.Check if you run itEPSS 0.41%Jan 28, 2026
- High7.5A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice (DoS) by invoking flow.cuda.get_device_properties() with an invalid or negative deCheck if you run itEPSS 0.59%Jan 28, 2026
- High7.5A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.synchronize() with an invalid or out-of-range GPU device indeCheck if you run itEPSS 0.50%Jan 28, 2026
- High7.5A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input.Check if you run itEPSS 0.43%Jan 28, 2026
- High7.5A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negative or excessively large dimension value.Check if you run itEPSS 0.43%Jan 28, 2026
- Medium6.5A division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input tensor with zero.Check if you run itEPSS 0.34%Jan 28, 2026
- High7.5A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted tensor shapes.Check if you run itEPSS 0.43%Jan 28, 2026
- High7.8The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability.Check if you run itEPSS 0.80%Jan 28, 2026
Sort