Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via $item['field_id'] in all versions up to, and including, 1.7.1036 dueCheck if you run itEPSS 0.20%Nov 19, 2025
- Medium5.3The New User Approve plugin for WordPress is vulnerable to unauthorized data disclosure in all versions up to, and including, 3.0.9 due to insufficient API key validation using looCheck if you run itEPSS 0.32%Nov 19, 2025
- Medium5.3The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.10.0 via the REST API endpoint and AJAXCheck if you run itEPSS 0.30%Nov 19, 2025
- Medium5.3The YITH WooCommerce Wishlist plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.10.0.Check if you run itEPSS 0.33%Nov 19, 2025
- Critical9.3When the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL with the same name as one loaded by the serCheck if you run itEPSS 0.19%Nov 19, 2025
- Medium5.6Tanium addressed an arbitrary file deletion vulnerability in TanOS.Check if you run itEPSS 0.17%Nov 19, 2025
- High8.4DLL Loading vulnerability in NEC Corporation RakurakuMusen Start EX All Verisons allows a attacker to manipulate the PC environment to cause unintended operations on the user's devCheck if you run itEPSS 0.15%Nov 19, 2025
- High7.3D-Link Router DIR-868L A1 FW106KRb01.bin has an unauthenticated remote code execution vulnerability in the cgibin binary.Check if you run itEPSS 8.08%Nov 19, 2025
- Medium6.1A reflected cross-site scripted (XSS) vulnerability in the /ecommerce/products.php component of E-commerce Project v1.0 and earlier allows attackers to execute arbitrary JavascriptCheck if you run itEPSS 0.25%Nov 19, 2025
- Medium6.5Github Restaurant Website Restoran v1.0 was discovered to contain a SQL injection vulnerability via the Contact Form page.Check if you run itEPSS 0.26%Nov 19, 2025
- High7.3Campcodes Online Hospital Management System 1.0 is vulnerable to SQL Injection in /admin/index.php via the parameter username.Check if you run itEPSS 0.22%Nov 19, 2025
- High7.5Milos Paripovic OneCommander 3.102.0.0 is vulnerable to Directory Traversal.Check if you run itEPSS 0.76%Nov 19, 2025
- Medium4.6A reflected cross-site scripting (XSS) vulnerability exists in the password change functionality of Pixeon WebLaudos 25.1 (01).Check if you run itEPSS 0.22%Nov 19, 2025
- Critical10.0The Itel DAB Encoder (IDEnc build 25aec8d) is vulnerable to Authentication Bypass due to improper JWT validation across devices.Check if you run itEPSS 0.74%Nov 19, 2025
- Critical9.8The Axel Technology StreamerMAX MK II devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgiCheck if you run itEPSS 0.80%Nov 19, 2025
- Critical9.1The Axel Technology puma devices (firmware versions 0.8.5 to 1.0.3) are vulnerable to Broken Access Control due to missing authentication on the /cgi-bin/gstFcgi.fcgi endpoint.Check if you run itEPSS 0.56%Nov 19, 2025
- High7.2The Sound4 FIRST web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package.Check if you run itEPSS 0.50%Nov 19, 2025
- High7.5The ITEL ISO FM SFN Adapter (firmware ISO2 2.0.0.0, WebServer 2.0) is vulnerable to session hijacking due to improper session management on the /home.html endpoint.Check if you run itEPSS 0.46%Nov 19, 2025
- Medium6.5An issue was discovered in bridgetech VBC Server & Element Manager, firmware version 6.5.0-10 , 6.5.0-9, allowing unauthorized attackers to delete and create arbitrary accounts.Check if you run itEPSS 0.31%Nov 19, 2025
- Critical9.8The QVidium Opera11 device (firmware version 2.9.0-Ax4x-opera11) is vulnerable to Remote Code Execution (RCE) due to improper input validation on the /cgi-bin/net_ping.cgi endpointCheck if you run itEPSS 0.95%Nov 19, 2025
- Medium6.5GatesAir Flexiva-LX devices on firmware 1.0.13 and 2.0, including models LX100, LX300, LX600, and LX1000, expose sensitive session identifiers (sid) in the publicly accessible logCheck if you run itEPSS 0.38%Nov 19, 2025
- Medium6.1Stored cross-site scripting vulnerability in bridgetech VBC Server & Element Manager, firmware versions 6.5.0-9 thru 6.5.0-10, allows attackers to execute arbitrary code via the adCheck if you run itEPSS 0.29%Nov 19, 2025
- Critical9.8The Newtec Celox UHD (models: CELOXA504, CELOXA820) running firmware version celox-21.6.13 is vulnerable to an authentication bypass.Check if you run itEPSS 0.58%Nov 19, 2025
- High7.5The ELCA Star Transmitter Remote Control firmware 1.25 for STAR150, BP1000, STAR300, STAR2000, STAR1000, STAR500, and possibly other models, contains an information disclosure vulnCheck if you run itEPSS 0.44%Nov 19, 2025
- High7.5An issue was discovered in bridgetech VB288 Objective QoE Content Extractor, firmware version 5.6.0-8, allowing attackers to gain sensitive information such as administrator passwoCheck if you run itEPSS 0.26%Nov 19, 2025
Sort