Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3Allows modifying some file metadata (e.g.Check if you run itEPSS 0.77%Jun 3, 2025
- High7.5When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior is that any filtered members would be skipped and not extracted.Check if you run itEPSS 0.59%Jun 3, 2025
- High7.5Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.Check if you run itEPSS 1.39%Jun 3, 2025
- High7.5Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata.Check if you run itEPSS 0.94%Jun 3, 2025
- Critical9.4Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data".Check if you run itEPSS 1.43%Jun 3, 2025
- Medium6.9A vulnerability was found in Netgear WNR614 1.1.0.28_1.0.1WW.Check if you run itEPSS 0.95%Jun 3, 2025
- Medium6.4The Popup Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘popupID' parameter in all versions up to, and including, 1.20.4 due to insufficient inputCheck if you run itEPSS 0.29%Jun 3, 2025
- Medium6.4The Music Player for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘album_buy_url’ parameter in all versions up to, and including, 2.4.6 due tCheck if you run itEPSS 0.29%Jun 3, 2025
- Medium6.4The Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's user_meta and compare shortcodes in all versions up to, and including, 3.13.8Check if you run itEPSS 0.29%Jun 3, 2025
- Medium5.3A vulnerability was found in Baison Channel Middleware Product 2.0.1 and classified as critical.Check if you run itEPSS 0.48%Jun 3, 2025
- Medium5.3A vulnerability has been found in D-Link DI-500WF-WT up to 20250511 and classified as critical.Check if you run itEPSS 2.61%Jun 3, 2025
- High7.8A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740).Check if you run itEPSS 0.32%Jun 3, 2025
- High7.8A privilege escalation vulnerability exists in the Snapshot functionality of Parallels Desktop for Mac version 20.1.1 (build 55740).Check if you run itEPSS 0.28%Jun 3, 2025
- High7.8A privilege escalation vulnerability exists in the virtual machine archive restoration functionality of Parallels Desktop for Mac version 20.1.1 (55740).Check if you run itEPSS 0.32%Jun 3, 2025
- High8.8A directory traversal vulnerability exists in the PVMP package unpacking functionality of Parallels Desktop for Mac version 20.2.2 (55879).Check if you run itEPSS 1.13%Jun 3, 2025
- High7.2The Shared Files – Frontend File Upload Form & Secure File Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via html File uploads in all versions up to, anCheck if you run itEPSS 0.36%Jun 3, 2025
- Medium4.9The Ultimate Gift Cards for WooCommerce plugin for WordPress is vulnerable to boolean-based SQL Injection via the 'default_price' and 'product_id' parameters in all versions up to,Check if you run itEPSS 0.38%Jun 3, 2025
- Medium6.4The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads inCheck if you run itEPSS 0.22%Jun 3, 2025
- High7.0Incorrect default permissions issue in PC Time Tracer prior to 5.2.Check if you run itEPSS 0.16%Jun 3, 2025
- Medium6.9Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in TimeWorks 10.0 to 10.3.Check if you run itEPSS 0.65%Jun 3, 2025
- Medium4.8The Post Slider and Post Carousel with Post Vertical Scrolling Widget WordPress plugin before 3.2.10 does not validate and escape some of its Widget options before outputting themCheck if you run itEPSS 0.25%Jun 3, 2025
- Medium6.1The FancyBox for WordPress plugin before 3.3.6 does not escape captions and titles attributes before using them to populate galleries' caption fields.Check if you run itEPSS 0.25%Jun 3, 2025
- Medium4.8The Newsletter WordPress plugin before 8.8.2 does not sanitise and escape some of its Subscription settings, which could allow high privilege users such as admin to perform StoredCheck if you run itEPSS 0.25%Jun 3, 2025
- High7.8memory corruption while processing IOCTL commands, when the buffer in write loopback mode is accessed after being freed.Check if you run itEPSS 0.10%Jun 3, 2025
- High7.5Transient DOS while processing the tone measurement response buffer when the response buffer is out of range.Check if you run itEPSS 0.24%Jun 3, 2025
Sort