Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical10.0The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, a…Check if you run itEPSS 0.46%Oct 14, 2026
- High8.6The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to i…Check if you run itEPSS 0.50%Oct 14, 2026
- Medium5.3The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private…Check if you run itEPSS 0.33%Oct 14, 2026
- Medium4.3The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authen…Check if you run itEPSS 0.26%Oct 14, 2026
- Medium6.8The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline scrip…Check if you run itEPSS 0.40%Oct 14, 2026
- Medium5.3The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allo…Check if you run itEPSS 0.16%Oct 14, 2026
- Medium5.3The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, all…Check if you run itEPSS 0.28%Oct 14, 2026
- High8.8The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an…Check if you run itEPSS 0.46%Oct 14, 2026
- Medium5.9The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unatta…Check if you run itEPSS 0.25%Oct 14, 2026
- Medium6.8The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the b…Check if you run itEPSS 0.32%Oct 14, 2026
- Medium5.3The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing un…Check if you run itEPSS 0.23%Oct 14, 2026
- Medium5.3The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data…Check if you run itEPSS 0.27%Oct 14, 2026
- Medium5.3The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission befor…Check if you run itEPSS 0.24%Oct 14, 2026
- Medium5.3The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result…Check if you run itEPSS 0.24%Oct 14, 2026
- Medium5.3The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to ret…Check if you run itEPSS 0.27%Oct 14, 2026
- Medium6.8The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe H…Check if you run itEPSS 0.32%Oct 14, 2026
- Medium5.3The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated u…Check if you run itEPSS 0.24%Oct 14, 2026
- Medium6.8The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline scr…Check if you run itEPSS 0.32%Oct 14, 2026
- High8.6The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and ve…Check if you run itEPSS 0.34%Oct 14, 2026
- Medium6.5A defect in the Qt for MCUs core string handling causes heap memory corruption.Check if you run itEPSS 0.33%Oct 14, 2026
- Medium4.7A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of serv…Check if you run itEPSS 0.11%Oct 14, 2026
- Medium5.3An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, wh…Check if you run itEPSS 0.33%Oct 14, 2026
- High8.6A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthori…Check if you run itEPSS 0.26%Oct 14, 2026
- Low3.7A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or trunc…Check if you run itEPSS 0.26%Oct 14, 2026
- Low3.7A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain informat…Check if you run itEPSS 0.27%Oct 14, 2026
Sort