Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3The Banhammer – Monitor Site Traffic, Block Bad Users and Bots plugin for WordPress is vulnerable to Blocking Bypass in all versions up to, and including, 3.4.8.Check if you run itEPSS 0.37%Sep 26, 2025
- Low2.7The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability checkCheck if you run itEPSS 0.22%Sep 26, 2025
- Medium6.4The Mega Elements – Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Countdown Timer widget in all versions up to, and includCheck if you run itEPSS 0.24%Sep 26, 2025
- Medium4.3The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.26.12.Check if you run itEPSS 0.17%Sep 26, 2025
- Medium6.4The Widgets for Tiktok Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'trustindex-feed' shortcode in all versions up to, and including, 1.7Check if you run itEPSS 0.20%Sep 26, 2025
- Medium6.4The CM Business Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'cmbd_featured_image' shortcode in all versions up to, and including, 1Check if you run itEPSS 0.24%Sep 26, 2025
- Medium5.1A security flaw has been discovered in MuYuCMS up to 2.7.Check if you run itEPSS 0.40%Sep 26, 2025
- Medium6.9A vulnerability was determined in roncoo roncoo-pay up to 9428382af21cd5568319eae7429b7e1d0332ff40.Check if you run itEPSS 0.37%Sep 26, 2025
- Medium5.3A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.1.Check if you run itEPSS 0.41%Sep 26, 2025
- Medium5.3A vulnerability was identified in YunaiV ruoyi-vue-pro up to 2025.09.Check if you run itEPSS 0.31%Sep 26, 2025
- Medium5.3A vulnerability was determined in YunaiV yudao-cloud up to 2025.09.Check if you run itEPSS 0.31%Sep 26, 2025
- Medium5.3A vulnerability was detected in JeecgBoot up to 3.8.2.Check if you run itEPSS 0.41%Sep 26, 2025
- Medium5.0Unitree Go2, G1, H1, and B2 devices through 2025-09-20 accept any handshake secret with the unitree substring.Check if you run itEPSS 0.20%Sep 26, 2025
- Medium4.7Unitree Go2, G1, H1, and B2 devices through 2025-09-20 decrypt BLE packet data by using the df98b715d5c6ed2b25817b6f2554124a key and the 2841ae97419c2973296a0d4bdfe19a4f IV.Check if you run itEPSS 0.19%Sep 26, 2025
- High8.2Unitree Go2, G1, H1, and B2 devices through 2025-09-20 allow root OS command injection via the hostapd_restart.sh wifi_ssid or wifi_pass parameter (within restart_wifi_ap and restaCheck if you run itEPSS 1.08%Sep 26, 2025
- Medium4.0Squid through 7.1 mishandles ASN.1 encoding of long SNMP OIDs.Check if you run itEPSS 0.41%Sep 26, 2025
- High7.1In DOXENSE WATCHDOC before 6.1.0.5094, private user puk codes can be disclosed for Active Directory registered users (there is hard-coded and predictable data).Check if you run itEPSS 0.14%Sep 26, 2025
- Critical10.0In DOXENSE WATCHDOC before 6.1.1.5332, Deserialization of Untrusted Data can lead to remote code execution through the .NET Remoting library in the Watchdoc administration interfacCheck if you run itEPSS 0.72%Sep 26, 2025
- Medium6.8PiranhaCMS 12.0 allows stored XSS in the Text content block of Standard and Standard Archive Pages via /manager/pages, enabling execution of arbitrary JavaScript in another user sCheck if you run itEPSS 0.33%Sep 26, 2025
- Medium6.1Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality.Check if you run itEPSS 0.24%Sep 26, 2025
- Medium6.8Mercusys MW305R 3.30 and below is has a Transport Layer Security (TLS) certificate private key disclosure.Check if you run itEPSS 0.20%Sep 26, 2025
- High8.8An issue was discovered in DIR-823 firmware 20250416.Check if you run itEPSS 0.41%Sep 26, 2025
- High8.8Wavlink M86X3A_V240730 contains a buffer overflow vulnerability in the /cgi-bin/ExportAllSettings.cgi file.Check if you run itEPSS 2.08%Sep 26, 2025
- Critical9.9In DriveLock 24.1.4 before 24.1.5, 24.2.5 before 24.2.6, and 25.1.2 before 25.1.4, attackers can gain elevated privileges.Check if you run itEPSS 0.46%Sep 26, 2025
- High7.5An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdirectory/1.Check if you run itEPSS 0.40%Sep 26, 2025
Sort