Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The SurveyFunnel – Survey Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'surveyfunnel_lite_survey' shortcode in all versions up to,Check if you run itEPSS 0.22%Dec 5, 2025
- High8.8The Demo Importer Plus plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 2.0.6.Check if you run itEPSS 0.55%Dec 5, 2025
- Medium5.1A flaw exists in the verification of application installation sources within ColorOS.Check if you run itEPSS 0.13%Dec 5, 2025
- Medium6.4The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'bookingcalendar' shortcode in all versions up to, and including, 10.14.6 dueCheck if you run itEPSS 0.18%Dec 5, 2025
- Medium4.3The Backup, Restore and Migrate your sites with XCloner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.2.Check if you run itEPSS 0.12%Dec 5, 2025
- Medium4.3User interface (ui) misrepresentation of critical information in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.Check if you run itEPSS 0.43%Dec 5, 2025
- Medium5.3A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0.Check if you run itEPSS 0.26%Dec 5, 2025
- Critical9.8Array Networks ArrayOS AG OS Command Injection VulnerabilityPatch nowKEVEPSS 3.42%Dec 5, 2025
- Medium4.7The KDE Connect protocol 8 before 2025-11-28 does not correlate device IDs across two packets.Check if you run itEPSS 0.20%Dec 5, 2025
- High8.8zdh_web is a data collection, processing, monitoring, scheduling, and management platform.Check if you run itEPSS 0.75%Dec 5, 2025
- High8.1Warehouse Management System 1.2 contains an authenticated arbitrary file deletion vulnerability.Check if you run itEPSS 0.79%Dec 5, 2025
- High7.5The warehouse management system version 1.2 contains an arbitrary file read vulnerability.Check if you run itEPSS 0.70%Dec 5, 2025
- High8.8Authentication Bypass via Hardcoded Credentials GoAway up to v0.62.18, fixed in 0.62.19, uses a hardcoded secret for signing JWT tokens used for authentication.Check if you run itEPSS 0.52%Dec 5, 2025
- High8.3Directory traversal vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store files in arbitrary locations and potentially modify the sCheck if you run itEPSS 0.81%Dec 5, 2025
- Medium4.3File upload vulnerability in Fanvil x210 V2 2.12.20 allows unauthenticated attackers on the local network to store arbitrary files on the filesystem.Check if you run itEPSS 0.23%Dec 5, 2025
- Critical9.6A reflected Cross Site Scripting (XSS) vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafCheck if you run itEPSS 0.44%Dec 5, 2025
- High7.5A Buffer overflow vulnerability on Fanvil x210 2.12.20 devices allows attackers to cause a denial of service or potentially execute arbitrary commands via crafted POST request to tCheck if you run itEPSS 2.89%Dec 5, 2025
- Medium5.1An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to execute arbitrary system commands.Check if you run itEPSS 2.82%Dec 5, 2025
- Medium4.3In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.Check if you run itEPSS 0.18%Dec 5, 2025
- Medium4.3In the KDE Connect information-exchange protocol before 2025-04-18, a packet can be crafted to temporarily change the displayed information about a device, because broadcast UDP isCheck if you run itEPSS 0.12%Dec 5, 2025
- Medium4.3In KDE Connect before 1.33.0 on Android, a packet can be crafted that causes two paired devices to unpair.Check if you run itEPSS 0.18%Dec 5, 2025
- Medium4.7The KDE Connect verification-code protocol before 2025-04-18 uses only 8 characters and therefore allows brute-force attacks.Check if you run itEPSS 0.15%Dec 5, 2025
- Medium5.0In CKSource CKFinder before 2.5.0.1 for ASP.NET, authenticated users could download any file from the server if the correct path to a file was provided.Check if you run itEPSS 0.34%Dec 5, 2025
- High8.7Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands.Check if you run itEPSS 0.44%Dec 4, 2025
- High7.5Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.Check if you run itEPSS 0.44%Dec 4, 2025
Sort