Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.8AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a negative note index.Check if you run itEPSS 0.13%Oct 15, 2026
- Medium6.9AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking.Check if you run itEPSS 0.14%Oct 15, 2026
- High7.5Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions…Check if you run itEPSS 0.51%Oct 15, 2026
- Medium5.3Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configu…Check if you run itEPSS 0.23%Oct 15, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This…Check if you run itEPSS 0.16%Oct 15, 2026
- Medium4.3Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Le…Check if you run itEPSS 0.18%Oct 15, 2026
- Medium5.3Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-wooc…Check if you run itEPSS 0.21%Oct 15, 2026
- Medium5.3Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploiting Incorrectly Configured Access Control…Check if you run itEPSS 0.21%Oct 15, 2026
- Medium6.5Insertion of Sensitive Information Into Sent Data vulnerability in ClikIT Infinite Uploads infinite-uploads allows Retrieve Embedded Sensitive Data.This issue affects…Check if you run itEPSS 0.27%Oct 15, 2026
- Medium5.3Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af…Check if you run itEPSS 0.23%Oct 15, 2026
- Medium5.9undici is an HTTP client library for Node.js.Check if you run itEPSS 0.31%Oct 15, 2026
- Medium5.9undici is an HTTP client library for Node.js.Check if you run itEPSS 0.31%Oct 15, 2026
- Medium5.4Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This is…Check if you run itEPSS 0.21%Oct 15, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.Th…Check if you run itEPSS 0.16%Oct 15, 2026
- High7.5undici is an HTTP client library for Node.js.Check if you run itEPSS 0.34%Oct 15, 2026
- Medium5.9undici is an HTTP client library for Node.js.Check if you run itEPSS 0.25%Oct 15, 2026
- High7.4undici is an HTTP client library for Node.js.Check if you run itEPSS 0.15%Oct 15, 2026
- Medium5.3Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This…Check if you run itEPSS 0.23%Oct 15, 2026
- High7.4undici is an HTTP client library for Node.js.Check if you run itEPSS 0.18%Oct 15, 2026
- Medium5.4The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub) renders a documentation U…Check if you run itEPSS 0.17%Oct 15, 2026
- Medium5.3Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec…Check if you run itEPSS 0.25%Oct 15, 2026
- High7.4A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator.Check if you run itEPSS 0.33%Oct 15, 2026
- Medium6.0temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for.Check if you run itEPSS 0.36%Oct 15, 2026
- Medium6.1ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue.Check if you run itEPSS 0.19%Oct 15, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Sto…Check if you run itEPSS 0.16%Oct 15, 2026