Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3IBM Business Automation Workflow 24.0.0 and 24.0.1 through 24.0.1 IF001 Center may leak sensitive information due to missing authorization validation.Check if you run itEPSS 0.26%May 3, 2025
- Medium6.9A vulnerability was found in PCMan FTP Server 2.0.7.Check if you run itEPSS 0.74%May 3, 2025
- High8.1Mojolicious versions from 0.999922 for Perl uses a hard coded string, or the application's class name, as an HMAC session cookie secret by default.Check if you run itEPSS 0.55%May 3, 2025
- Medium6.1IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF004 and 24.0.1 through 24.0.1 IF001 is vulnerable to cross-site scripting.Check if you run itEPSS 0.26%May 3, 2025
- Medium6.9A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical.Check if you run itEPSS 0.74%May 3, 2025
- Medium6.9A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical.Check if you run itEPSS 0.74%May 3, 2025
- High8.6In the Linux kernel, the following vulnerability has been resolved: vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp vmxnet3 driver's XDP handling is buggy for packet siCheck if you run itEPSS 0.36%May 3, 2025
- Medium5.3Mojolicious versions from 7.28 through 9.45 for Perl will generate weak HMAC session cookie secrets via "mojo generate app" by default.Check if you run itEPSS 0.57%May 3, 2025
- Medium6.4The SurveyJS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.12.32 due to insufficient input sanitiCheck if you run itEPSS 0.31%May 3, 2025
- High7.3The The Motors - Car Dealer, Rental & Listing WordPress theme theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.6.65.Check if you run itEPSS 0.52%May 3, 2025
- Medium5.9The Database Toolset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.4 via backup files stored in a publicly accessibCheck if you run itEPSS 0.47%May 3, 2025
- Medium6.1The Abundatrade Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.02.Check if you run itEPSS 0.18%May 3, 2025
- Medium6.4The Personizely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘widgetId’ parameter in all versions up to, and including, 0.10 due to insufficient inputCheck if you run itEPSS 0.31%May 3, 2025
- Medium6.1The Alink Tap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.1.Check if you run itEPSS 0.18%May 3, 2025
- Medium6.4The Subpage List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'subpages' shortcode in all versions up to, and including, 1.3.3 due to insufficCheck if you run itEPSS 0.24%May 3, 2025
- Critical9.8The Job Listings plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the register_action() function in versions 0.1 to 0.1.1.Check if you run itEPSS 0.57%May 3, 2025
- Medium6.1The Advanced Reorder Image Text Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.18%May 3, 2025
- Medium6.4The Xavin's Review Ratings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'xrr' shortcode in all versions up to, and including, 1.4.0 due tCheck if you run itEPSS 0.24%May 3, 2025
- Medium6.4The VerticalResponse Newsletter Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'verticalresponse' shortcode in all versions up to, and inCheck if you run itEPSS 0.24%May 3, 2025
- High8.1In BlueWave Checkmate through 2.0.2 before d4a6072, an invite request can be modified to specify a privileged role.Check if you run itEPSS 0.50%May 3, 2025
- High7.3Inedo ProGet through 2024.22 allows remote attackers to reach restricted functionality through the C# reflection layer, as demonstrated by causing a denial of service (when an attaCheck if you run itEPSS 0.47%May 3, 2025
- Medium4.0In browser-use (aka Browser Use) before 0.1.45, URL parsing of allowed_domains is mishandled because userinfo can be placed in the authority component.Check if you run itEPSS 0.45%May 3, 2025
- Medium5.5libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a denial of service (var_set_leave_quiet assertion failure and application exit) via crafted input data, such asCheck if you run itEPSS 0.18%May 3, 2025
- High7.8OpenVM is a performant and modular zkVM framework built for customization and extensibility.Check if you run itEPSS 0.47%May 2, 2025
- High7.5In the Linux kernel, the following vulnerability has been resolved: scsi: target: Fix WRITE_SAME No Data Buffer crash In newer version of the SBC specs, we have a NDOB bit that indCheck if you run itEPSS 0.45%May 2, 2025
Sort