Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.9cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable.Check if you run itEPSS 0.14%Jun 26, 2025
- High7.2The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due to insufficient inputCheck if you run itEPSS 0.30%Jun 26, 2025
- High8.8When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address.Check if you run itEPSS 0.26%Jun 26, 2025
- High8.6A user with specific node group editing permissions and a specially crafted class parameter could be used to execute commands as root on the primary host.Check if you run itEPSS 1.06%Jun 26, 2025
- Medium5.1Cross-site request forgery vulnerability exists in iroha Board versions v0.10.12 and earlier.Check if you run itEPSS 0.14%Jun 26, 2025
- Medium5.3Direct request ('Forced Browsing') issue exists in iroha Board versions v0.10.12 and earlier.Check if you run itEPSS 0.24%Jun 26, 2025
- Medium5.3An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed unauthenticated attCheck if you run itEPSS 0.30%Jun 26, 2025
- Low3.1An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated usersCheck if you run itEPSS 0.31%Jun 26, 2025
- Medium6.5An issue has been discovered in GitLab CE/EE affecting all versions from 10.7 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated attacCheck if you run itEPSS 0.37%Jun 26, 2025
- Medium4.3An issue has been discovered in GitLab CE/EE affecting all versions from 17.2 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated usersCheck if you run itEPSS 0.26%Jun 26, 2025
- Low2.7An issue has been discovered in GitLab EE affecting all versions from 16.10 before 17.11.5, 18.0 before 18.0.3, and 18.1 before 18.1.1 that could have allowed authenticated users tCheck if you run itEPSS 0.27%Jun 26, 2025
- High8.7A potential security vulnerability has been identified in HPE OneView for VMware vCenter (OV4VC).Check if you run itEPSS 0.30%Jun 26, 2025
- Low2.4Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs.Check if you run itEPSS 0.18%Jun 26, 2025
- Medium6.4The web-cam plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slug’ parameter in all versions up to, and including, 3.0 due to insufficient input sanitizatCheck if you run itEPSS 0.26%Jun 26, 2025
- Medium6.4The Drive Folder Embedder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablecssclass’ parameter in all versions up to, and including, 1.1.0 due to insCheck if you run itEPSS 0.19%Jun 26, 2025
- Medium5.3The Amazon Products to WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcta2w_get_amazon_product_callbaCheck if you run itEPSS 0.26%Jun 26, 2025
- Medium6.4The TimeZoneCalculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'timezonecalculator_output' shortcode in all versions up to, and includingCheck if you run itEPSS 0.19%Jun 26, 2025
- Medium6.4The WP SoundSystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpsstm-track shortcode in all versions up to, and including, 3.4.2 due to insuCheck if you run itEPSS 0.22%Jun 26, 2025
- Medium6.4The GC Social Wall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gc_social_wall' shortcode in all versions up to, and including, 1.15 due to iCheck if you run itEPSS 0.21%Jun 26, 2025
- Medium6.4The WP-PhotoNav plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's photonav shortcode in all versions up to, and including, 1.2.2 due to insufficienCheck if you run itEPSS 0.20%Jun 26, 2025
- Medium6.4The Tournament Bracket Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bracket' shortcode in all versions up to, and including, 1.0.0Check if you run itEPSS 0.19%Jun 26, 2025
- Critical9.8The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3.Check if you run itEPSS 2.59%Jun 26, 2025
- Medium4.3The VG WORT METIS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gutenberg_save_post() function in all versions upCheck if you run itEPSS 0.28%Jun 26, 2025
- High8.8The Owl carousel responsive plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.9 due to insufficient escaCheck if you run itEPSS 0.40%Jun 26, 2025
- Medium6.4The WP Masonry & Infinite Scroll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wmis' shortcode in all versions up to, and including, 2.2 due tCheck if you run itEPSS 0.25%Jun 26, 2025
Sort