Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3A flaw was found in libtirpc.Check if you run itEPSS 0.23%Oct 16, 2026
- Medium4.3User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()Check if you run itEPSS 0.15%Oct 16, 2026
- Medium6.1Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' ParameterCheck if you run itEPSS 0.23%Oct 16, 2026
- UnknownSecurity update for libsoup2Open the advisoryOct 16, 2026
- High7.5A flaw was found in spice-server.Check if you run itEPSS 0.25%Oct 16, 2026
- High7.5A flaw was found in spice-server.Check if you run itEPSS 0.40%Oct 16, 2026
- High8.1Important: kernel security, bug fix, and enhancement updateOpen the advisoryOct 16, 2026
- High8.6Important: libsoup security updateOpen the advisoryOct 16, 2026
- High8.8Important: kernel security updateOpen the advisoryOct 16, 2026
- High8.8Important: kernel-rt security, bug fix, and enhancement updateOpen the advisoryOct 16, 2026
- UnknownSecurity update for ImageMagickOpen the advisoryOct 16, 2026
- UnknownSecurity update for libsoupOpen the advisoryOct 16, 2026
- Medium6.5Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an o…Check if you run itEPSS 0.22%Oct 16, 2026
- Medium6.4The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'twitteruse…Check if you run itEPSS 0.22%Oct 16, 2026
- Critical9.8The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and…Check if you run itEPSS 0.51%Oct 16, 2026
- UnknownMalicious code in @flexmr/survey-client (npm)Open the advisoryOct 16, 2026
- High7.2The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' function in ver…Check if you run itEPSS 0.19%Oct 16, 2026
- High7.2The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due…Check if you run itEPSS 0.24%Oct 16, 2026
- High8.1The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versio…Check if you run itEPSS 0.34%Oct 16, 2026
- High7.4OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute ForceCheck if you run itEPSS 0.27%Oct 16, 2026
- High8.8Salon Booking System < 10.31.9 - Administrator Account Creation via CSRFCheck if you run itEPSS 0.15%Oct 16, 2026
- High7.5The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is d…Check if you run itEPSS 0.35%Oct 16, 2026
- Medium4.3The Image Hub – Free Images from Unsplash, Pixabay, Pexels, Openverse & Giphy plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up t…Check if you run itEPSS 0.28%Oct 16, 2026
- Medium6.1The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due…Check if you run itEPSS 0.21%Oct 16, 2026
- High7.8Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents.Check if you run itEPSS 0.14%Oct 16, 2026