Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7.Check if you run itEPSS 0.89%Oct 16, 2026
- Medium6.5The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to,…Check if you run itEPSS 0.27%Oct 16, 2026
- High7.5The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and…Check if you run itEPSS 0.38%Oct 16, 2026
- Medium6.1The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5.1.1 due…Check if you run itEPSS 0.21%Oct 16, 2026
- Medium6.5The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and incl…Check if you run itEPSS 0.28%Oct 16, 2026
- Medium4.4ZDI-26-780: X.Org Server GestureBuildSprite Use-After-Free Information Disclosure VulnerabilityOpen the advisoryOct 16, 2026
- High7.8ZDI-26-782: LibreOffice PDF File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityCheck if you run itEPSS 0.19%Oct 16, 2026
- High7.8ZDI-26-783: LibreOffice PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityCheck if you run itEPSS 0.12%Oct 16, 2026
- High7.8ZDI-26-781: LibreOffice EMF+ Brush Integer Overflow Remote Code Execution VulnerabilityCheck if you run itEPSS 0.17%Oct 16, 2026
- High7.8ZDI-26-785: FreeBSD Kernel Shared Memory Time-Of-Check Time-Of-Use Local Privilege Escalation VulnerabilityCheck if you run itEPSS 0.12%Oct 16, 2026
- High8.8ZDI-26-784: FreeBSD Kernel kqueue Use-After-Free Local Privilege Escalation VulnerabilityCheck if you run itEPSS 0.10%Oct 16, 2026
- High8.0The Backuply – Backup, Restore, Migrate and Clone plugin for WordPress is vulnerable to SQL Injection via the Biographical Info field (second-order, via restore) in al…Check if you run itEPSS 0.34%Oct 16, 2026
- Medium6.4The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attri…Check if you run itEPSS 0.16%Oct 16, 2026
- Medium4.3The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Ref…Check if you run itEPSS 0.21%Oct 16, 2026
- Medium6.4The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and includ…Check if you run itEPSS 0.24%Oct 16, 2026
- High7.8Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents.Check if you run itEPSS 0.14%Oct 16, 2026
- Medium5.9Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application.Check if you run itEPSS 0.14%Oct 16, 2026
- Medium5.9Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default).Check if you run itEPSS 0.21%Oct 16, 2026
- Low3.7Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems.Check if you run itEPSS 0.21%Oct 16, 2026
- High8.1Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved.Check if you run itEPSS 0.28%Oct 16, 2026
- High8.6Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development.Check if you run itEPSS 0.26%Oct 16, 2026
- High8.1Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=).Check if you run itEPSS 0.28%Oct 16, 2026
- Critical9.8Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to i…Check if you run itEPSS 0.26%Oct 16, 2026
- Medium6.5Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-…Check if you run itEPSS 0.16%Oct 16, 2026
- Medium5.3Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags.Check if you run itEPSS 0.23%Oct 16, 2026