Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Flow-Flow Social Feed Stream plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the flow_flow_social_auth AJAX actionCheck if you run itEPSS 0.25%Dec 12, 2025
- Medium4.3The BMLT WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.11.4.Check if you run itEPSS 0.15%Dec 12, 2025
- High7.0When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept network traffic betweeCheck if you run itEPSS 0.10%Dec 12, 2025
- Medium5.4The High Level Synthesis Compiler i++ command for Windows is vulnerable to a DLL planting vulnerabilityCheck if you run itEPSS 0.12%Dec 12, 2025
- High7.0When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can intercept network traCheck if you run itEPSS 0.18%Dec 12, 2025
- Medium5.4Uncontrolled Search Path Element vulnerability in Altera High Level Synthesis Compiler on Windows allows Search Order Hijacking.This issue affects High Level Synthesis Compiler: frCheck if you run itEPSS 0.12%Dec 12, 2025
- High7.5The LT Unleashed plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.1 via the 'template' parameter in the shortcode due to insuffiCheck if you run itEPSS 0.58%Dec 12, 2025
- Medium6.4The LJUsers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'ljuser' shortcode in all versions up to, and including, 1.2.0 due toCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium5.4The System Console Utility for Windows is vulnerable to a DLL planting vulnerabilityCheck if you run itEPSS 0.11%Dec 12, 2025
- High8.2Unchecked output buffer may allowed arbitrary code execution in SMM and potentially result in SMM memory corruption.Check if you run itEPSS 0.15%Dec 12, 2025
- Medium4.9An issue was discovered in Weaviate OSS before 1.33.4.Check if you run itEPSS 0.50%Dec 12, 2025
- High7.2An issue was discovered in Weaviate OSS before 1.33.4.Check if you run itEPSS 0.91%Dec 12, 2025
- Medium4.6jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint.Check if you run itEPSS 0.17%Dec 12, 2025
- Medium4.6RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint.Check if you run itEPSS 0.18%Dec 12, 2025
- Medium4.6jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability.Check if you run itEPSS 0.17%Dec 12, 2025
- Critical9.1Plesk 18.0 has Incorrect Access Control.Check if you run itEPSS 0.55%Dec 12, 2025
- Critical9.8Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full account takeover.Check if you run itEPSS 0.49%Dec 12, 2025
- High8.8An eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows attackers to overwrite arbitrary files as root via scanning a crafted file.Check if you run itEPSS 0.30%Dec 12, 2025
- Medium4.3Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint.Check if you run itEPSS 0.32%Dec 12, 2025
- High8.8Apple Multiple Products Use-After-Free WebKit VulnerabilityPatch nowKEVEPSS 25.65%Dec 12, 2025
- High7.1Gladinet CentreStack and Triofox Hard Coded Cryptographic VulnerabilityPatch nowKEVEPSS 53.30%Dec 12, 2025
- High8.8Google Chromium Out of Bounds Memory Access VulnerabilityPatch nowKEVEPSS 55.33%Dec 12, 2025
- Low3.3Malwarebytes 1.0.14 for Linux doesn't properly compute signatures in some scenarios.Check if you run itEPSS 0.21%Dec 12, 2025
- High7.5It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific case.Check this weekEPSS 19.99%Dec 11, 2025
- Medium4.2SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2.Check if you run itEPSS 0.17%Dec 11, 2025
Sort