Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.11 via the wpematico_test_feed() functionCheck if you run itEPSS 0.24%Nov 5, 2025
- Medium6.3The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticatCheck if you run itEPSS 0.19%Nov 5, 2025
- Medium5.3The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downCheck if you run itEPSS 0.35%Nov 5, 2025
- High8.8Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications.Check if you run itEPSS 0.23%Nov 5, 2025
- Medium5.7Out-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.Check if you run itEPSS 0.12%Nov 5, 2025
- High7.5StellarWP the_events_calendar Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 18.24%Nov 5, 2025
- Medium6.4The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, andCheck if you run itEPSS 0.23%Nov 5, 2025
- Medium5.3The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due toCheck if you run itEPSS 0.23%Nov 5, 2025
- Medium6.1The SMS for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in all versions up to, and including, 1.1.8 due to insufficientCheck if you run itEPSS 0.27%Nov 5, 2025
- Medium5.6The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mime_coCheck if you run itEPSS 0.30%Nov 5, 2025
- Medium4.3The Features plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'features_revert_option AJAX endpoint in all versionsCheck if you run itEPSS 0.19%Nov 5, 2025
- Medium5.5An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules.Check if you run itEPSS 0.21%Nov 5, 2025
- Medium5.3ownCloud guests Exposure of Sensitive Information to an Unauthorized ActorPatch nowKEVEPSS 0.95%Nov 5, 2025
- High8.3An Incorrect Access Control vulnerability in the user management component of ZwiiCMS up to v13.6.07 allows a remote, authenticated attacker to escalate their privileges.Check if you run itEPSS 0.39%Nov 5, 2025
- Critical9.1Tonec Internet Download Manager 6.42.41.1 and earlier suffers from Missing SSL Certificate Validation, which allows attackers to bypass update protections.Check if you run itEPSS 0.25%Nov 5, 2025
- Critical9.8meowapps ai_engine Exposure of Sensitive Information to an Unauthorized ActorPatch nowKEVEPSS 74.66%Nov 5, 2025
- UnknownMoodle moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 1.13%Nov 5, 2025
- High8.8Mantis Bug Tracker (MantisBT) is an open source issue tracker.Check if you run itEPSS 0.34%Nov 4, 2025
- High8.2NVIDIA NVApp for Windows contains a vulnerability in the installer, where a local attacker can cause a search path element issue.Check if you run itEPSS 0.24%Nov 4, 2025
- Medium6.2NVIDIA RunAI for all platforms contains a vulnerability where a user could cause an improper restriction of communications channels on an adjacent network.Check if you run itEPSS 0.16%Nov 4, 2025
- Critical10.0Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests.Check if you run itEPSS 0.74%Nov 4, 2025
- Critical10.0Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file.Check if you run itEPSS 0.66%Nov 4, 2025
- Medium4.4The MeetingList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 0.11 due to insufficient input sanitizatiCheck if you run itEPSS 0.21%Nov 4, 2025
- Critical9.8The Easy Upload Files During Checkout plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing file type validation in the 'file_during_checkout' funcCheck if you run itEPSS 0.65%Nov 4, 2025
- Medium5.9The overly permissive sandbox configuration in DSPy allows attackers to steal sensitive files in cases when users build an AI agent which consumes user input and uses the “PythonInCheck if you run itEPSS 0.34%Nov 4, 2025
Sort