Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.2The Community Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event details parameter in all versions up to, and including, 1.5.2 due to insufficient iCheck if you run itEPSS 0.29%Nov 1, 2025
- Medium4.3The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due to insufficient restCheck if you run itEPSS 0.23%Nov 1, 2025
- Medium4.3The SiteSEO – SEO Simplified plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.3.1.Check if you run itEPSS 0.23%Nov 1, 2025
- Medium4.4The CSS & JavaScript Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 12.0.5 due to insufficient iCheck if you run itEPSS 0.19%Nov 1, 2025
- Medium6.9Blogs in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 GA through update 9Check if you run itEPSS 0.29%Nov 1, 2025
- Medium6.4The Inactive Logout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ina_redirect_page_individual_user' parameter in all versions up to, and including, 3.Check if you run itEPSS 0.24%Nov 1, 2025
- High8.8The WPCOM Member plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.14 via the action parameter in one of its shortcodes.Check if you run itEPSS 0.56%Nov 1, 2025
- Medium5.3The Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missinCheck if you run itEPSS 0.30%Nov 1, 2025
- Medium5.3The Document Library Lite plugin for WordPress is vulnerable to Improper Authorization in all versions up to, and including, 1.1.6.Check if you run itEPSS 0.37%Nov 1, 2025
- Critical9.8WPExperts post_smtp Missing AuthorizationPatch nowKEVEPSS 61.48%Nov 1, 2025
- Medium4.6The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3Check if you run itEPSS 0.13%Oct 31, 2025
- Medium6.2A stack-based buffer overflow was found in the QEMU e1000 network device.Check if you run itEPSS 0.18%Oct 31, 2025
- High7.6When SmartStart Inclusion fails during the onboarding of a Z-Wave PIR sensor, the sensor will join the network as a non-secure device.Check if you run itEPSS 0.32%Oct 31, 2025
- Medium6.3A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1.Check if you run itEPSS 0.79%Oct 31, 2025
- Medium5.1A vulnerability was determined in LogicalDOC Community Edition up to 9.2.1.Check if you run itEPSS 0.29%Oct 31, 2025
- Critical9.3ELOG allows an authenticated user to modify or overwrite the configuration file, resulting in denial of service.Check if you run itEPSS 0.32%Oct 31, 2025
- High8.6ELOG allows an authenticated user to upload arbitrary HTML files.Check if you run itEPSS 0.32%Oct 31, 2025
- Medium4.6Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 throughCheck if you run itEPSS 0.23%Oct 31, 2025
- Medium5.1Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 througCheck if you run itEPSS 0.24%Oct 31, 2025
- Low1.8If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.Check if you run itEPSS 0.15%Oct 31, 2025
- Medium6.9Missing Security Headers.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.Check if you run itEPSS 0.37%Oct 31, 2025
- High8.4On a client with an admin user, a Global_Shipping script can be implemented.Check if you run itEPSS 0.29%Oct 31, 2025
- High8.4When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted.Check if you run itEPSS 0.20%Oct 31, 2025
- High8.8The service Bizerba Communication Server (BCS) has an unquoted service path.Check if you run itEPSS 0.14%Oct 31, 2025
- Critical10.0Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.Check if you run itEPSS 0.22%Oct 31, 2025
Sort