Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The WP AD Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'startindex' parameter of the ad-gallery shortcode in all versions up to, and including,Check if you run itEPSS 0.19%Oct 22, 2025
- Medium5.3Stored Cross-site Scripting (XSS) in Oct8ne Chatbot v2.3.Check if you run itEPSS 0.19%Oct 22, 2025
- High7.0Encrypted WiFi and SSH credentials were found in the Ghost Robotics Vision 60 v0.27.2 APK.Check if you run itEPSS 0.25%Oct 22, 2025
- High8.7Ghost Robotics Vision 60 v0.27.2 includes, among its physical interfaces, three RJ45 connectors and a USB Type-C port.Check if you run itEPSS 0.63%Oct 22, 2025
- Critical9.2The communication protocol implemented in Ghost Robotics Vision 60 v0.27.2 could allow an attacker to send commands to the robot from an external attack station, impersonating theCheck if you run itEPSS 0.31%Oct 22, 2025
- High7.5An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests.Check if you run itEPSS 0.47%Oct 22, 2025
- Critical9.8The importFile SOAP method is vulnerable to a directory traversal attack.Check if you run itEPSS 1.35%Oct 22, 2025
- High7.5The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages.Check if you run itEPSS 0.27%Oct 22, 2025
- Low2.7A high privileged remote attacker can influence the parameters passed to the openssl command due to improper neutralization of special elements when adding a password protected selCheck if you run itEPSS 0.20%Oct 22, 2025
- Medium4.3A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.Check if you run itEPSS 0.18%Oct 22, 2025
- High8.8A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion of all previously conCheck if you run itEPSS 0.55%Oct 22, 2025
- Medium4.3The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the save_refund_reCheck if you run itEPSS 0.19%Oct 22, 2025
- Medium4.4The Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website plugin for WordPress is vulnerable to Stored Cross-Site ScriptCheck if you run itEPSS 0.19%Oct 22, 2025
- Medium4.3The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 11.1.2.Check if you run itEPSS 0.16%Oct 22, 2025
- Medium6.5The Meta Tag Manager WordPress plugin before 3.3 does not restrict which roles can create http-equiv refresh meta tags.Check if you run itEPSS 0.26%Oct 22, 2025
- Medium5.3The NS Maintenance Mode for WP WordPress plugin through 1.3.1 lacks authorization in its subscriber export function allowing unauthenticated attackers to download a list of a site'Check if you run itEPSS 0.25%Oct 22, 2025
- Medium5.5The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'order_mail' setting in versions up to, and including, 2.11.22.Check if you run itEPSS 0.25%Oct 22, 2025
- High8.7This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server.Check if you run itEPSS 0.50%Oct 22, 2025
- High8.0Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.Check if you run itEPSS 0.28%Oct 22, 2025
- Low3.1On Mercku M6a devices through 2.1.0, the authentication system uses predictable session tokens based on timestamps.Check if you run itEPSS 0.19%Oct 22, 2025
- Low2.4Mercku M6a devices through 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator.Check if you run itEPSS 0.17%Oct 22, 2025
- Low3.1On Mercku M6a devices through 2.1.0, session tokens remain valid for at least months in some cases.Check if you run itEPSS 0.16%Oct 22, 2025
- High7.5Mercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks.Check if you run itEPSS 0.15%Oct 22, 2025
- High7.5Multiple buffer overflows in the AdvSetMacMtuWan function of Tenda AC6 v.15.03.06.50 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payload into the waCheck if you run itEPSS 0.41%Oct 22, 2025
- High7.5Tenda AC6 V2.0 15.03.06.50 was discovered to contain a stack overflow in the page parameter in the addressNat function.Check if you run itEPSS 0.42%Oct 22, 2025
Sort