Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3Active debug code vulnerability in SFM Software Technologies Inc.Check if you run itEPSS 0.20%Oct 16, 2026
- Medium6.5Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc.Check if you run itEPSS 0.19%Oct 16, 2026
- UnknownSecurity update for ImageMagickOpen the advisoryOct 16, 2026
- UnknownSecurity update for libsoupOpen the advisoryOct 16, 2026
- Critical9.3An SQL injection vulnerability has been discovered in TSG Profleet.Check if you run itEPSS 0.23%Oct 16, 2026
- Medium6.5Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action integration secrets from post payloads before broadca…Check if you run itEPSS 0.25%Oct 16, 2026
- Medium4.5Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize authentication tokens before writing them to server log…Check if you run itEPSS 0.24%Oct 16, 2026
- Medium4.4Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth application sessions in the account type switch endpo…Check if you run itEPSS 0.20%Oct 16, 2026
- Medium4.3Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack import account binding to system administrator-init…Check if you run itEPSS 0.15%Oct 16, 2026
- Medium4.3Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s permissions before other validations which allows…Check if you run itEPSS 0.18%Oct 16, 2026
- Medium4.3Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict private teams from public team search results, w…Check if you run itEPSS 0.16%Oct 16, 2026
- Medium5.0Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team…Check if you run itEPSS 0.16%Oct 16, 2026
- High7.1Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which a…Check if you run itEPSS 0.19%Oct 16, 2026
- Medium6.5Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during…Check if you run itEPSS 0.28%Oct 16, 2026
- Medium6.4The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versions up to…Check if you run itEPSS 0.24%Oct 16, 2026
- High7.5Observable response discrepancy vulnerability in IKAS Technology Inc.Check if you run itEPSS 0.24%Oct 16, 2026
- Critical9.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Inje…Check if you run itEPSS 0.24%Oct 16, 2026
- High8.8The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7…Check if you run itEPSS 0.57%Oct 16, 2026
- High8.8The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the parameter of the…Check if you run itEPSS 1.47%Oct 16, 2026
- Medium4.3Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notifi…Check if you run itEPSS 0.21%Oct 16, 2026
- Medium4.3The Wp Map Block plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the set_status() and bulk() functions in…Check if you run itEPSS 0.20%Oct 16, 2026
- Medium4.3Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API…Check if you run itEPSS 0.18%Oct 16, 2026
- Medium4.9Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection…Check if you run itEPSS 0.23%Oct 16, 2026
- Medium6.5Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an o…Check if you run itEPSS 0.22%Oct 16, 2026
- Medium6.4Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated u…Check if you run itEPSS 0.15%Oct 16, 2026