Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a post's Featured Image custom fields in all versions up to, and including,Check if you run itEPSS 0.20%Oct 7, 2025
- High8.7A vulnerability was found in Tenda AC23 up to 16.03.07.52.Check if you run itEPSS 0.82%Oct 7, 2025
- High8.7A vulnerability has been found in UTT 1250GW up to v2v3.2.2-200710.Check if you run itEPSS 0.85%Oct 7, 2025
- Medium5.3A flaw has been found in code-projects Online Hotel Reservation System 1.0.Check if you run itEPSS 0.40%Oct 7, 2025
- High8.6The Admin and Customer Messages After Order for WooCommerce: OrderConvo WordPress plugin through 15.1 does not validate the path of files to be downloaded, which could allow unauthCheck if you run itEPSS 4.40%Oct 7, 2025
- Medium5.3A vulnerability was detected in code-projects Online Hotel Reservation System 1.0.Check if you run itEPSS 0.33%Oct 7, 2025
- Medium5.3A security vulnerability has been detected in code-projects Online Hotel Reservation System 1.0.Check if you run itEPSS 0.33%Oct 7, 2025
- High8.7Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in filCheck if you run itEPSS 0.43%Oct 7, 2025
- Medium5.3A weakness has been identified in code-projects Online Hotel Reservation System 1.0.Check if you run itEPSS 0.33%Oct 7, 2025
- Medium6.9A security flaw has been discovered in Campcodes Online Apartment Visitor Management System 1.0.Check if you run itEPSS 0.42%Oct 7, 2025
- Medium6.9A vulnerability was identified in Campcodes Online Apartment Visitor Management System 1.0.Check if you run itEPSS 0.42%Oct 7, 2025
- Medium6.9A vulnerability was determined in Campcodes Online Apartment Visitor Management System 1.0.Check if you run itEPSS 0.42%Oct 7, 2025
- Medium6.9A vulnerability was found in code-projects Student Crud Operation up to 3.3.Check if you run itEPSS 0.53%Oct 7, 2025
- Low2.9In Ankitects Anki before 25.02.6, crafted sound file references could cause files to be written to arbitrary locations on Windows and Linux (media file pathnames are not necessarilCheck if you run itEPSS 0.18%Oct 7, 2025
- Medium6.7Ankitects Anki before 25.02.5 allows a crafted shared deck on Windows to execute arbitrary commands when playing audio because of URL scheme mishandling.Check if you run itEPSS 0.14%Oct 7, 2025
- Medium6.7In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link in the deck.Check if you run itEPSS 0.15%Oct 7, 2025
- Medium6.1Sourcecodester Markdown to HTML Converter v1.0 is vulnerable to a Cross-Site Scripting (XSS) in the "Markdown Input" field, allowing a remote attacker to inject arbitrary HTML/JavaCheck if you run itEPSS 0.28%Oct 7, 2025
- High8.2CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems via the /api/logs/insert/elasticsearch/_bulk endpoint.Check if you run itEPSS 0.37%Oct 7, 2025
- Medium6.1A Cross-Site Scripting (XSS) vulnerability was found in the register.php page of PuneethReddyHC Event Management System 1.0, where the event_id GET parameter is improperly handled.Check if you run itEPSS 0.23%Oct 7, 2025
- Critical9.8A SQL Injection vulnerability exists in the edit_product.php file of PuneethReddyHC Online Shopping System Advanced 1.0.Check if you run itEPSS 0.33%Oct 7, 2025
- High7.8Clash Verge Rev thru 2.2.3 (fixed in 2.3.0) forces the installation of system services(clash-verge-service) by default and exposes key functions through the unauthorized HTTP API ,Check if you run itEPSS 0.24%Oct 7, 2025
- High8.5Nagios Log Server before 2024R1.3.2 allows authenticated users (with read-only API access) to stop the Elasticsearch service via a /nagioslogserver/index.php/api/system/stop?subsysCheck if you run itEPSS 2.77%Oct 7, 2025
- Critical9.9Nagios Log Server before 2024R1.3.2 allows authenticated users to retrieve cleartext administrative API keys via a /nagioslogserver/index.php/api/system/get_users call.Check this weekEPSS 16.88%Oct 7, 2025
- High8.6Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contains an authentication bypass vulnerability.Check if you run itEPSS 0.45%Oct 6, 2025
- Critical9.3PyVista provides 3D plotting and mesh analysis through an interface for the Visualization Toolkit (VTK).Check if you run itEPSS 0.65%Oct 6, 2025
Sort