Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1The Lesson Plan Book plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 1.3 due to insufficient input sanitCheck if you run itEPSS 0.26%Jan 9, 2026
- High8.7This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the transmission of credentials encoded using reversible Base64 eCheck if you run itEPSS 0.12%Jan 9, 2026
- High8.7This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the plaintext transmission of login credentials during the initiaCheck if you run itEPSS 0.12%Jan 9, 2026
- Critical10.0Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the hostname of the device.Check if you run itEPSS 0.77%Jan 9, 2026
- Low3.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed a user to leak cerCheck if you run itEPSS 0.27%Jan 9, 2026
- High8.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticatedCheck if you run itEPSS 0.42%Jan 9, 2026
- Medium6.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated usCheck if you run itEPSS 0.52%Jan 9, 2026
- Medium5.4GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated uCheck if you run itEPSS 0.43%Jan 9, 2026
- High7.1GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated userCheck if you run itEPSS 0.42%Jan 9, 2026
- High8.0GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbCheck if you run itEPSS 0.70%Jan 9, 2026
- Medium6.5GitLab has remediated an issue in GitLab EE affecting all versions from 18.5 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an authenticated userCheck if you run itEPSS 0.45%Jan 9, 2026
- High7.5This vulnerability allows unauthenticated attackers to inject an SQL request into GET request parameters and directly query the underlying database.Check if you run itEPSS 0.40%Jan 9, 2026
- High8.6This vulnerability allows authenticated attackers to execute commands via the NTP-configuration of the device.Check if you run itEPSS 0.37%Jan 9, 2026
- Critical10.0This vulnerability allows authenticated attackers to execute commands via the hostname of the device.Check if you run itEPSS 0.42%Jan 9, 2026
- Medium6.1The Top Position Google Finance plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the variable in all versions up to, and including, 0.1.0 due to insufficienCheck if you run itEPSS 0.25%Jan 9, 2026
- Medium6.4The WP Popup Magic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the [wppum_end] shortcode in all versions up to, and including, 1.0Check if you run itEPSS 0.22%Jan 9, 2026
- Medium6.4The Nearby Now Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_tech' parameter of the nn-tech shortcode in all versions up to, and includingCheck if you run itEPSS 0.22%Jan 9, 2026
- Medium6.4The Entry Views plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'entry-views' shortcode in all versions up to, and including, 1.0.0 due to insuffCheck if you run itEPSS 0.22%Jan 9, 2026
- Medium6.4The AMP for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.1.10.Check if you run itEPSS 0.22%Jan 9, 2026
- High7.6A flaw was found in GNU Wget2.Check if you run itEPSS 0.35%Jan 9, 2026
- High8.8A security issue was discovered in GNU Wget2 when handling Metalink documents.Check if you run itEPSS 0.79%Jan 9, 2026
- Medium4.3The WP Table Builder – Drag & Drop Table Builder plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect authorization check on the save_table()Check if you run itEPSS 0.26%Jan 9, 2026
- Critical9.1The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to missing authorization to unauthorized data modification and deletion due to a missing capability check on theCheck if you run itEPSS 0.38%Jan 9, 2026
- High7.2The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acff' parameter in the 'frontend_admin/forms/update_field' AJAX action iCheck if you run itEPSS 0.29%Jan 9, 2026
- Medium4.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized modification and deletion of data due to a missing capability check on the 'Check if you run itEPSS 0.22%Jan 9, 2026
Sort