Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- None0.0Not usedOpen the advisoryNov 5, 2025
- High8.4Optical Disc Archive Software provided by Sony Corporation registers a Windows service with an unquoted file path.Check if you run itEPSS 0.17%Nov 5, 2025
- High8.4Multiple Roboticsware products provided by Roboticsware PTE.Check if you run itEPSS 0.17%Nov 5, 2025
- Medium6.3The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticatCheck if you run itEPSS 0.19%Nov 5, 2025
- Medium5.3The MelAbu WP Download Counter Button WordPress plugin through 1.8.6.7 does not validate the path of files to be downloaded, which could allow unauthenticated attacker to read/downCheck if you run itEPSS 0.35%Nov 5, 2025
- Medium5.3The ElementInvader Addons for Elementor WordPress plugin before 1.4.1 allows unauthenticated user to send arbitrary e-mails to arbitrary addresses due to missing authorization on tCheck if you run itEPSS 0.25%Nov 5, 2025
- Medium6.3The FunnelKit WordPress plugin before 3.12.0.1 does not sanitize user input before echoing it back in some of its checkout-related AJAX actions, allowing attackers to conduct refleCheck if you run itEPSS 0.18%Nov 5, 2025
- High7.1Improper input validation in Samsung Members prior to version 5.5.01.3 allows remote attackers to connect arbitrary URL and launch arbitrary activity with Samsung Members privilegeCheck if you run itEPSS 0.57%Nov 5, 2025
- High8.8Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications.Check if you run itEPSS 0.23%Nov 5, 2025
- Low3.3Improper input validation in Samsung Email prior to version 6.2.06.0 allows local attackers to launch arbitrary activity with Samsung Email privilege.Check if you run itEPSS 0.12%Nov 5, 2025
- Medium5.5Improper handling of insufficient permissions or privileges in Samsung Account prior to version 15.5.00.18 allows local attackers to access data in Samsung Account.Check if you run itEPSS 0.14%Nov 5, 2025
- Medium4.3Out-of-bounds write in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory.Check if you run itEPSS 0.28%Nov 5, 2025
- Medium4.3Out-of-bounds read in libimagecodec.quram.so prior to SMR Nov-2025 Release 1 allows remote attackers to access out-of-bounds memory.Check if you run itEPSS 0.29%Nov 5, 2025
- Medium6.8Insecure default configuration in USB connection mode prior to SMR Nov-2025 Release 1 allows privileged physical attackers to access user data.Check if you run itEPSS 0.20%Nov 5, 2025
- Medium5.7Out-of-bounds write in handling opcode in fingerprint trustlet prior to SMR Nov-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.Check if you run itEPSS 0.12%Nov 5, 2025
- High7.5StellarWP the_events_calendar Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 18.24%Nov 5, 2025
- Medium6.4The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom CSS in all versions up to, andCheck if you run itEPSS 0.23%Nov 5, 2025
- Medium5.3The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to unauthorized modification of data due toCheck if you run itEPSS 0.23%Nov 5, 2025
- Medium6.1The SMS for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'paged' parameter in all versions up to, and including, 1.1.8 due to insufficientCheck if you run itEPSS 0.27%Nov 5, 2025
- Medium5.6The Everest Forms (Pro) plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.9.7 via deserialization of untrusted input in the mime_coCheck if you run itEPSS 0.30%Nov 5, 2025
- Medium4.3The Features plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'features_revert_option AJAX endpoint in all versionsCheck if you run itEPSS 0.19%Nov 5, 2025
- Critical9.8The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined variables.Check if you run itEPSS 1.76%Nov 5, 2025
- Critical9.9Snipe-IT before version 8.3.3 contains a remote code execution vulnerability that allows an authenticated attacker to upload a malicious backup file containing arbitrary files andCheck if you run itEPSS 0.64%Nov 5, 2025
- Medium6.5OSSN (Open Source Social Network) 8.6 is vulnerable to SQL Injection in /action/rtcomments/status via the timestamp parameter.Check if you run itEPSS 0.21%Nov 5, 2025
- Medium6.1A DOM-based Cross-Site Scripting (XSS) vulnerability in the SelfBest platform 2023.3 allows attackers to execute arbitrary JavaScript in the context of a logged-in user's session bCheck if you run itEPSS 0.23%Nov 5, 2025
Sort