Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys.Check if you run itEPSS 0.50%Dec 2, 2025
- Medium4.0Insufficient encryption strength in Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 allows a local unprivileged attacker to extract data from update images and thusCheck if you run itEPSS 0.07%Dec 2, 2025
- Critical9.1Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confidCheck if you run itEPSS 0.44%Dec 2, 2025
- Medium4.8Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary JavaScript code, whichCheck if you run itEPSS 0.22%Dec 2, 2025
- Low2.1Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to force the server to performCheck if you run itEPSS 0.33%Dec 2, 2025
- Low2.3Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connected users and then access suCheck if you run itEPSS 0.19%Dec 2, 2025
- Medium4.3Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards, which allows an authCheck if you run itEPSS 0.24%Dec 2, 2025
- High7.5The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'month' parameter in all versions up to, and including, 1.4Check if you run itEPSS 0.36%Dec 2, 2025
- High8.1The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0.Check if you run itEPSS 1.04%Dec 2, 2025
- High8.8The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2.Check if you run itEPSS 0.29%Dec 2, 2025
- Medium6.3In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exceeds 65535 byCheck if you run itEPSS 0.24%Dec 2, 2025
- High8.8Insecure Storage of Sensitive Information vulnerability in MeetMe on iOS, Android allows Retrieve Embedded Sensitive Data.Check if you run itEPSS 0.13%Dec 2, 2025
- Medium4.3The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4.Check if you run itEPSS 0.34%Dec 2, 2025
- Medium5.3The Zigaform plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.6.5.Check if you run itEPSS 0.33%Dec 2, 2025
- Medium4.3The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20.Check if you run itEPSS 0.16%Dec 2, 2025
- Medium6.5The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'query' parameter in all versions up to, and including, 3.11.12Check if you run itEPSS 0.32%Dec 2, 2025
- Medium4.3The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8.Check if you run itEPSS 0.17%Dec 2, 2025
- Medium6.1The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.2Check if you run itEPSS 0.28%Dec 2, 2025
- Medium4.1The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as admin to perform SQL iCheck if you run itEPSS 0.27%Dec 2, 2025
- High7.7The db-access WordPress plugin through 0.8.7 does not have authorization in an AJAX action, allowing any authenticated users, such as subscriber to perform SQLI attacksCheck if you run itEPSS 0.34%Dec 2, 2025
- Medium6.5The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.19.Check if you run itEPSS 0.17%Dec 2, 2025
- High7.2The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and including, 1.5.17 due to iCheck if you run itEPSS 0.32%Dec 2, 2025
- Medium4.4In GPU pdma, there is a possible information disclosure due to a missing bounds check.Check if you run itEPSS 0.08%Dec 2, 2025
- Medium4.4In GPU pdma, there is a possible memory corruption due to a missing permission check.Check if you run itEPSS 0.08%Dec 2, 2025
- Medium6.7In display, there is a possible out of bounds write due to a missing bounds check.Check if you run itEPSS 0.09%Dec 2, 2025
Sort