Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.9The WP Crontrol plugin for WordPress is vulnerable to blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the 'wp_remote_request' function.Check if you run itEPSS 0.36%Aug 22, 2025
- High8.4Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path.Check if you run itEPSS 0.17%Aug 22, 2025
- High7.1The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could bCheck if you run itEPSS 0.25%Aug 22, 2025
- Medium6.8Post-authenticated external control of system web interface configuration setting vulnerability in Danfoss AK-SM8xxA Series prior to 4.3.1, which could allow for a denial of servicCheck if you run itEPSS 0.92%Aug 22, 2025
- High8.7Improper neutralization of alarm-to-mail configuration fields used in an OS shell Command ('Command Injection') in Danfoss AK-SM8xxA Series prior to version 4.3.1, leading to a potCheck if you run itEPSS 4.46%Aug 22, 2025
- Medium5.3Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.QCheck if you run itEPSS 0.33%Aug 22, 2025
- Critical9.8Authentication Bypass Using an Alternate Path or ChannelPatch nowKEVEPSS 0.77%Aug 22, 2025
- Critical9.8The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device.Check if you run itEPSS 2.88%Aug 22, 2025
- Medium6.5Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to contain a command injection vulnerability via the setddns_pip_system()Check if you run itEPSS 1.70%Aug 22, 2025
- High7.5Incorrect access control in the RTMP server settings of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows unauthorized attackers toCheck if you run itEPSS 0.54%Aug 22, 2025
- Medium4.0Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to manage users' sessions system wide instead of an account-by-account baCheck if you run itEPSS 0.14%Aug 22, 2025
- High7.3A discrepancy in the error message returned by the login function of Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 when entering the wCheck if you run itEPSS 0.27%Aug 22, 2025
- Medium6.5Insecure permissions in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allow attackers to arbitrarily change other users' passwords viaCheck if you run itEPSS 0.21%Aug 22, 2025
- Medium5.3Insufficient privilege verification in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows authenticated attackers to create accountsCheck if you run itEPSS 0.24%Aug 22, 2025
- Medium5.3An Insecure Direct Object Reference (IDOR) vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows unauthorized attackerCheck if you run itEPSS 0.24%Aug 22, 2025
- Medium6.3An open redirect vulnerability in Reolink v4.54.0.4.20250526 allows attackers to redirect users to a malicious site via a crafted URL.Check if you run itEPSS 0.23%Aug 22, 2025
- Medium5.3An intent redirection vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access internal functions or access non-public components.Check if you run itEPSS 0.33%Aug 22, 2025
- Medium5.4An issue in the lock screen component of Reolink v4.54.0.4.20250526 allows attackers to bypass authentication via using an ADB (Android Debug Bridge).Check if you run itEPSS 0.31%Aug 22, 2025
- Medium6.5Reolink v4.54.0.4.20250526 was discovered to contain a task hijacking vulnerability due to inappropriate taskAffinity settings.Check if you run itEPSS 0.34%Aug 22, 2025
- Medium6.5An Insecure Direct Object Reference (IDOR) vulnerability in Reolink v4.54.0.4.20250526 allows unauthorized attackers to access and download other users' profile photos via a crafteCheck if you run itEPSS 0.24%Aug 22, 2025
- Medium6.1A cross-site scripting (XSS) vulnerability in the valuateJavascript() function of Reolink v4.54.0.4.20250526 allows attackers to execute arbitrary web scripts or HTML via a craftedCheck if you run itEPSS 0.23%Aug 22, 2025
- Critical9.8Tenda O3V2 1.0.0.12(3880) is vulnerable to Buffer Overflow in the fromSafeSetMacFilter function via the mac parameter.Check if you run itEPSS 0.56%Aug 22, 2025
- High7.3D-Link DCS-825L firmware version 1.08.01 and possibly prior versions contain an insecure implementation in the mydlink-watch-dog.sh script.Check if you run itEPSS 0.19%Aug 22, 2025
- High8.8QuantumNous new-api v.0.8.5.2 is vulnerable to Cross Site Scripting (XSS).Check if you run itEPSS 0.42%Aug 22, 2025
- Low3.5DooTask v1.0.51 was dicovered to contain an authenticated arbitrary download vulnerability via the component /msg/sendtext.Check if you run itEPSS 0.28%Aug 22, 2025
Sort