Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.5phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that lets delegated administrators…Open the advisoryOct 17, 2026
- High7.0phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission API, whose updatePermissions and updateMembers endp…Open the advisoryOct 17, 2026
- High7.0phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops per-right language restricti…Open the advisoryOct 17, 2026
- Medium5.3phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in the admin dashboard that allows authenticated user…Open the advisoryOct 17, 2026
- Medium5.1phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right to modify news by calling PU…Open the advisoryOct 17, 2026
- High7.0phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in GroupController::deleteGroup() that omits privilege-level checks on target groups.Open the advisoryOct 17, 2026
- High8.7phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user control panel (UserController…Open the advisoryOct 17, 2026
- High8.6phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP tw…Open the advisoryOct 17, 2026
- Medium6.5The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account, allowing attackers to make a logged-in administrator…Check if you run itEPSS 0.11%Oct 17, 2026
- Medium6.8The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticate…Check if you run itEPSS 0.16%Oct 17, 2026
- Medium6.6The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not restrict which PHP classes may be instantiated when it deserialises stored post content…Check if you run itEPSS 0.20%Oct 17, 2026
- Medium5.3The ACF Frontend Admin by DynamiApps WordPress plugin through 3.29.13 does not perform a capability check on one of its form-submission actions before writing submitte…Check if you run itEPSS 0.13%Oct 17, 2026
- MediumShopper is a Headless e-commerce Admin Panel.Check if you run itEPSS 0.28%Oct 17, 2026
- MediumA use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4.Check if you run itEPSS 0.14%Oct 17, 2026
- CriticalDockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC iss, aud, nonce and exp cl…Check if you run itEPSS 0.39%Oct 17, 2026
- Medium5.4weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' ParameterCheck if you run itEPSS 0.28%Oct 16, 2026
- High7.2Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' ParameterCheck if you run itEPSS 0.28%Oct 16, 2026
- Medium4.9Post Export Import with Media <= 1.17.2 - Authenticated (Administrator+) Path Traversal via 'theme_slug' ParameterCheck if you run itEPSS 0.77%Oct 16, 2026
- Medium4.3User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()Check if you run itEPSS 0.15%Oct 16, 2026
- High7.5WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' ActionCheck if you run itEPSS 0.32%Oct 16, 2026
- High7.2EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' ParameterCheck if you run itEPSS 0.24%Oct 16, 2026
- Medium6.5LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX ActionCheck if you run itEPSS 0.25%Oct 16, 2026
- High7.2Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template ImportCheck if you run itEPSS 0.47%Oct 16, 2026
- Medium6.0A flaw was found in luksmeta.Check if you run itEPSS 0.11%Oct 16, 2026
- Medium4.3Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-init…Check if you run itEPSS 0.15%Oct 16, 2026