Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5AstrBot Project v3.5.22 has an arbitrary file read vulnerability in function _encode_image_bs64.Check if you run itEPSS 0.34%Nov 7, 2025
- Medium5.3lakeFS is an open-source tool that transforms object storage into a Git-like repositories.Check if you run itEPSS 0.29%Nov 6, 2025
- Medium5.3ThinkDashboard is a self-hosted bookmark dashboard built with Go and vanilla JavaScript.Check if you run itEPSS 0.35%Nov 6, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Cross Site Request Forgery.This issue affectsCheck if you run itEPSS 0.12%Nov 6, 2025
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in Shahjahan Jewel WP GDPR Cookie Consent wp-gdpr-cookie-consent allows Stored XSS.This issue affects WP GDPR Cookie Consent: from nCheck if you run itEPSS 0.13%Nov 6, 2025
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in ZIPANG Simple Stripe simple-stripe allows Stored XSS.This issue affects Simple Stripe: from n/a through <= 0.9.17.Check if you run itEPSS 0.13%Nov 6, 2025
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in andriassundskard wpNamedUsers wpnamedusers allows Stored XSS.This issue affects wpNamedUsers: from n/a through <= 0.5.Check if you run itEPSS 0.13%Nov 6, 2025
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in Norbert Slick Google Map slick-google-map allows Stored XSS.This issue affects Slick Google Map: from n/a through <= 0.3.Check if you run itEPSS 0.13%Nov 6, 2025
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in nitinmaurya12 Block Country block-country allows Stored XSS.This issue affects Block Country: from n/a through <= 1.0.Check if you run itEPSS 0.12%Nov 6, 2025
- Medium4.3The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 8.6.0 via the getFullConCheck if you run itEPSS 0.21%Nov 6, 2025
- Medium4.3The Easy Email Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.Check if you run itEPSS 0.13%Nov 6, 2025
- High7.1An unauthenticated reflected cross-site scripting vulnerability in the query handling of CMSimpleXH allows remote attackers to inject and execute arbitrary JavaScript in a victim'sCheck if you run itEPSS 0.36%Nov 6, 2025
- High7.5A Server-Side Request Forgery (SSRF) vulnerability, achievable through an XML External Entity (XXE) injection, exists in MetInfo Content Management System (CMS) thru 8.1.Check if you run itEPSS 0.51%Nov 6, 2025
- High7.3A Server-Side Request Forgery (SSRF) in the /api/proxy/ component of linshenkx prompt-optimizer v1.3.0 to v1.4.2 allows attackers to scan internal resources via a crafted request.Check if you run itEPSS 0.25%Nov 6, 2025
- Medium5.4HCL iAutomate v6.5.1 and v6.5.2 is susceptible to a sensitive information disclosure.Check if you run itEPSS 0.19%Nov 5, 2025
- Medium4.3A vulnerability in the API subsystem of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to obtain sensitive information from an affected system.Check if you run itEPSS 0.27%Nov 5, 2025
- Medium4.9A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to perform a directory traversal and access arbitrary resources.Check if you run itEPSS 1.14%Nov 5, 2025
- High8.6A vulnerability in the RADIUS setting Reject RADIUS requests from clients with repeated failures on Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attaCheck if you run itEPSS 0.71%Nov 5, 2025
- Medium4.2HCL BigFix Query is affected by a sensitive information disclosure in the WebUI Query application.Check if you run itEPSS 0.17%Nov 5, 2025
- Medium6.4The B Carousel Block – Responsive Image and Content Carousel plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 1.1.5.Check if you run itEPSS 0.23%Nov 5, 2025
- Medium6.4The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.8.11 via the wpematico_test_feed() functionCheck if you run itEPSS 0.24%Nov 5, 2025
- Medium6.3The Ace User Management WordPress plugin through 2.0.3 does not properly validate that a password reset token is associated with the user who requested it, allowing any authenticatCheck if you run itEPSS 0.19%Nov 5, 2025
- High7.5DWSurvey 6.14.0 is vulnerable to Incorrect Access Control.Check if you run itEPSS 0.32%Nov 5, 2025
- Medium6.5A vulnerability in the XiaozhangBang Voluntary Like System V8.8 allows remote attackers to manipulate the zhekou parameter in the /topfirst.php Pay module, enabling unauthorized diCheck if you run itEPSS 0.39%Nov 5, 2025
- Medium5.4OpenKM Community Edition 6.3.12 is vulnerable to stored cross-site scripting (XSS) in the user account creation interface.Check if you run itEPSS 0.22%Nov 5, 2025
Sort