Catalog
Findings
Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.
- Unknownlibpcre2-16-0-10.49-2.1 on GA mediaOct 16, 2026
- Unknownliboath-devel-2.6.15-1.1 on GA mediaOct 16, 2026
- Unknownlibrecad-2.2.1.5-2.1 on GA mediaOct 16, 2026
- UnknownlibXtst-devel-1.2.5-3.1 on GA mediaOct 16, 2026
- Unknownhawk2-2.7.2+git.1792148770.648dcddb-1.1 on GA mediaOct 16, 2026
- Unknowngoogle-osconfig-agent-20261015.00-1.1 on GA mediaOct 16, 2026
- Unknowndpdk-25.11.4-1.1 on GA mediaOct 16, 2026
- Unknowncurl-8.23.0-1.1 on GA mediaOct 16, 2026
- Unknowncoredns-1.14.7-3.1 on GA mediaOct 16, 2026
- Unknownalsa-1.2.16.1-3.1 on GA mediaOct 16, 2026
- High7.2The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Si…Oct 16, 2026
- Medium6.4Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer RoleOct 16, 2026
- High7.2The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter i…Oct 16, 2026
- High8.1Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects Gravity Forms: from n/a before 3.1.1.Oct 16, 2026
- Medium6.4The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions…Oct 16, 2026
- Medium4.3Arcane: Environment access token bypasses the admin-required authorization gate onOct 16, 2026
- High8.8Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)Oct 16, 2026
- Critical9.2Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command ExecutionOct 16, 2026
- High7.2The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to…Oct 16, 2026
- Medium6.5The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1.Oct 16, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects H…Oct 16, 2026
- Critical10.0Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.KEVOct 16, 2026
- Low3.1ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)Oct 16, 2026
- Low3.3ClickMigrate has Path Traversal in "revision -m" argumentOct 16, 2026
- Low3.7CoreDNS headless AXFR can emit an empty transfer batch that panics the pluginEPSS 0.5%Oct 16, 2026