Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.5Link Library <= 7.9.2 - Unauthenticated SQL Injection via 'link_url' ParameterOct 15, 2026
- Medium6.1Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'Oct 15, 2026
- High7.2Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' ParameterOct 15, 2026
- Medium6.1Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' ParameterOct 15, 2026
- High7.2Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' ParameterOct 15, 2026
- High7.2Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'Oct 15, 2026
- High8.1Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment IDOct 15, 2026
- Medium6.4Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile FieldsOct 15, 2026
- Medium6.5Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode Execution via 'oceanwp_library' Shortcode TemplateOct 15, 2026
- Medium6.4Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' AttributeOct 15, 2026
- Medium5.3A flaw was found in OpenSSH.Oct 15, 2026
- Medium5.4A flaw was found in OpenSSH.Oct 15, 2026
- Medium6.5A flaw was found in OpenSSH.Oct 15, 2026
- Medium5.7A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.Oct 15, 2026
- Medium4.7A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.Oct 15, 2026
- High7.1A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.Oct 15, 2026
- Medium6.4Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text ContentOct 15, 2026
- Critical9.810Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' ParameterOct 15, 2026
- High7.3PhastPress <= 3.10 - Unauthenticated Server-Side Request Forgery via 'src' ParameterOct 15, 2026
- Medium6.4A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operationsOct 15, 2026
- High8.6Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement.Oct 15, 2026
- Critical9.5In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific…Oct 15, 2026
- High7.1In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length…Oct 15, 2026
- Critical9.8Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query build…Oct 15, 2026
- Medium5.0Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project.Oct 15, 2026