Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.4The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2.Check if you run itEPSS 0.32%Mar 13, 2026
- Medium6.4The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2 due to missing validation on a user controlled key iCheck if you run itEPSS 0.26%Mar 13, 2026
- High7.2Use of Hard-coded Credentials vulnerability in Avantra allows Accessing Functionality Not Properly Constrained by ACLs.Check if you run itEPSS 0.23%Mar 13, 2026
- High7.5The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28.Check if you run itEPSS 0.35%Mar 13, 2026
- High7.5NSquared simply_schedule_appointments Missing AuthorizationPatch nowKEVEPSS 0.34%Mar 13, 2026
- Medium4.3The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and incCheck if you run itEPSS 0.25%Mar 13, 2026
- Critical9.8The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommercCheck this weekEPSS 34.33%Mar 13, 2026
- Medium6.9The authentication mechanism for a specific feature in the EasyShare module contains a vulnerability.Check if you run itEPSS 0.19%Mar 13, 2026
- Medium6.4A container privilege escalation flaw was found in certain Fuse images.Check if you run itEPSS 0.24%Mar 13, 2026
- Medium6.4A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images.Check if you run itEPSS 0.19%Mar 13, 2026
- Medium6.9wpDiscuz before 7.6.47 contains a missing rate limiting vulnerability that allows unauthenticated attackers to subscribe arbitrary email addresses to post notifications by sendingCheck if you run itEPSS 0.37%Mar 13, 2026
- Medium5.3wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability in the getFollowsPage() function that allows attackers to trigger unauthorized actions without nonce valiCheck if you run itEPSS 0.18%Mar 13, 2026
- Low2.1wpDiscuz before 7.6.47 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through unescaped attachment URLs in HTML output by exploiting tCheck if you run itEPSS 0.19%Mar 13, 2026
- Medium6.3wpDiscuz before 7.6.47 contains an email header injection vulnerability that allows attackers to manipulate mail recipients by injecting malicious data into the comment_author_emaiCheck if you run itEPSS 0.26%Mar 13, 2026
- Medium6.9wpDiscuz before 7.6.47 contains an information disclosure vulnerability that allows administrators to inadvertently expose OAuth secrets by exporting plugin options as JSON.Check if you run itEPSS 0.32%Mar 13, 2026
- Medium6.1wpDiscuz before 7.6.47 contains a cross-site request forgery vulnerability that allows attackers to delete all comments associated with an email address by crafting a malicious GETCheck if you run itEPSS 0.19%Mar 13, 2026
- Medium6.9wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusteCheck if you run itEPSS 0.18%Mar 13, 2026
- Critical9.2wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries.Check if you run itEPSS 0.35%Mar 13, 2026
- Medium5.1Beghelli Sicuro24 SicuroWeb contains a template injection vulnerability that allows attackers to inject arbitrary AngularJS expressions by exploiting improper rendering of untrusteCheck if you run itEPSS 0.39%Mar 13, 2026
- Medium5.3wpDiscuz before 7.6.47 contains a stored cross-site scripting vulnerability in the inline comment preview functionality that allows authenticated users to inject malicious scriptsCheck if you run itEPSS 0.20%Mar 13, 2026
- High8.7wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificatiCheck if you run itEPSS 0.59%Mar 13, 2026
- Medium5.4Statamic is a Laravel and Git powered content management system (CMS).Check if you run itEPSS 0.26%Mar 12, 2026
- High7.5PyJWT is a JSON Web Token implementation in Python.Check if you run itEPSS 0.30%Mar 12, 2026
- Medium5.3soroban-sdk is a Rust SDK for Soroban contracts.Check if you run itEPSS 0.31%Mar 12, 2026
- High7.5Ella Core is a 5G core designed for private networks.Check if you run itEPSS 0.20%Mar 12, 2026
Sort