Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.0Deck Mate 2's firmware update mechanism accepts packages without cryptographic signature verification, encrypts them with a single hard-coded AES key shared across devices, and useCheck if you run itEPSS 0.15%Oct 24, 2025
- High8.9An authenticated admin user with access to both the management WebUI and command line interface on a Firebox can enable a diagnostic debug shell by uploading a platform and versionCheck if you run itEPSS 0.32%Oct 24, 2025
- High8.6GN4 Publishing System versions prior to 2.6 contain an insecure direct object reference (IDOR) vulnerability via the API.Check if you run itEPSS 0.42%Oct 24, 2025
- High7.5Observable Discrepancy, Exposure of Sensitive Information to an Unauthorized Actor, Exposure of Private Personal Information to an Unauthorized Actor vulnerability in CBK Soft SoftCheck if you run itEPSS 0.34%Oct 24, 2025
- Medium4.3The AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 1.6.5.Check if you run itEPSS 0.29%Oct 24, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: vhost: Take a reference on the task in struct vhost_task.Check if you run itEPSS 0.15%Oct 24, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't expose sysfs attributes not applicable for VFs VFs can't read BMG_PCIE_CAP(0x138340) register nCheck if you run itEPSS 0.18%Oct 24, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Commit 1b34cbbf4f01 ("crypto: af_alg - Disallow concCheck if you run itEPSS 0.24%Oct 24, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: tracing: dynevent: Add a missing lockdown check on dynevent Since dynamic_events interface on tracefs is compatiCheck if you run itEPSS 0.21%Oct 24, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: can: peak_usb: fix shift-out-of-bounds issue Explicitly uses a 64-bit constant when the number of bits used forCheck if you run itEPSS 0.21%Oct 24, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: crypto: essiv - Check ssize for decryption and in-place encryption Move the ssize check to the start in essiv_aeCheck if you run itEPSS 0.29%Oct 24, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: ipvs: Defer ip_vs_ftp unregister during netns cleanup On the netns cleanup path, __ip_vs_ftp_exit() may unregistCheck if you run itEPSS 0.15%Oct 24, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: net: sched: cls_u32: Undo tcf_bind_filter if u32_replace_hw_knode When u32_replace_hw_knode fails, we need to unCheck if you run itEPSS 0.15%Oct 24, 2025
- High7.5The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to Server-Side Request Forgery in all versCheck if you run itEPSS 0.38%Oct 24, 2025
- Medium4.3WSO2 api_control_plane Authentication Bypass by SpoofingPatch nowKEVEPSS 0.85%Oct 24, 2025
- Medium5.9SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users.Check if you run itEPSS 0.62%Oct 24, 2025
- Medium5.3The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for WordPress is vulnerable to unauthorized modification of data dCheck if you run itEPSS 0.24%Oct 24, 2025
- Medium6.8The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.2.4.Check if you run itEPSS 0.39%Oct 24, 2025
- Critical9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aksis Technology Inc.Check if you run itEPSS 0.43%Oct 24, 2025
- Medium6.1The VNPAY Payment gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.0.0 due to insuffCheck if you run itEPSS 0.22%Oct 24, 2025
- Medium5.4The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1.Check if you run itEPSS 0.27%Oct 24, 2025
- Medium4.3The Check Plagiarism plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the chk_plag_mine_plugin_wpse10500_admin_action()Check if you run itEPSS 0.19%Oct 24, 2025
- Medium4.3The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ai_get_table' function in all versions upCheck if you run itEPSS 0.21%Oct 24, 2025
- Medium4.3The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_scan_result_remove' function in all versiCheck if you run itEPSS 0.24%Oct 24, 2025
- Medium4.3The NGINX Cache Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nginxcacheoptimizer-blacklist-update' AJCheck if you run itEPSS 0.20%Oct 24, 2025
Sort