Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.5An attacker with knowledge of creating user accounts during VM deployment on Google Cloud Platform (GCP) using the OS Login feature, can login via SSH gaining command-line controlCheck if you run itEPSS 0.21%Apr 17, 2025
- Critical9.0A valid, authenticated user with sufficient privileges and who is aware of Continuous Compliance’s internal database configurations can leverage the application’s built-in ConnectoCheck if you run itEPSS 0.34%Apr 17, 2025
- Low3.5The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored CrossCheck if you run itEPSS 0.28%Apr 17, 2025
- Low3.5The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored CrossCheck if you run itEPSS 0.28%Apr 17, 2025
- Low3.5The Ultimate Dashboard WordPress plugin before 3.8.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored CrossCheck if you run itEPSS 0.28%Apr 17, 2025
- High7.5The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data atCheck if you run itEPSS 0.52%Apr 17, 2025
- Low3.5The Icegram Express formerly known as Email Subscribers WordPress plugin before 5.7.52 does not sanitise and escape some of its settings, which could allow high privilege users sucCheck if you run itEPSS 0.28%Apr 17, 2025
- Medium4.9The WP Editor plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.9.1.Check if you run itEPSS 0.55%Apr 17, 2025
- High7.2The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1.Check if you run itEPSS 1.04%Apr 17, 2025
- Medium6.9A missing authorization vulnerability in the retrieve teacher Information function of Wisdom Master Pro versions 5.0 through 5.2 allows remote attackers to obtain partial user dataCheck if you run itEPSS 0.47%Apr 17, 2025
- Medium5.3An unrestricted upload of file with dangerous type vulnerability in the course management function of Wisdom Master Pro versions 5.0 through 5.2 allows remote authenticated users tCheck if you run itEPSS 0.47%Apr 17, 2025
- Critical9.9A improper control of filename for include/require statement in PHP program vulnerability in the retrieve course Information function of Wisdom Master Pro versions 5.0 through 5.2Check if you run itEPSS 0.50%Apr 17, 2025
- None0.0This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.Open the advisoryApr 17, 2025
- High8.1A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS.Check if you run itEPSS 0.28%Apr 17, 2025
- Medium5.4In PEAR HTTP_Request2 before 2.7.0, multiple files in the tests directory, notably tests/_network/getparameters.php and tests/_network/postparameters.php, reflect any GET or POST pCheck if you run itEPSS 0.34%Apr 17, 2025
- High8.1Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directoryCheck if you run itEPSS 0.33%Apr 17, 2025
- Low3.3VisiCut 2.1 allows stack consumption via an XML document with nested set elements, as demonstrated by a java.util.HashMap StackOverflowError when reference='../../../set/set[2]' isCheck if you run itEPSS 0.41%Apr 17, 2025
- Low2.9In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read.Check if you run itEPSS 0.60%Apr 17, 2025
- Medium6.3A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users.Check if you run itEPSS 0.19%Apr 17, 2025
- Critical9.8A RCE vulnerability in the core application in LandChat 3.25.12.18 allows an unauthenticated attacker to execute system code via remote network access.Check if you run itEPSS 0.62%Apr 17, 2025
- High7.2Litepubl CMS <= 7.0.9 is vulnerable to RCE in admin/service/run.Check if you run itEPSS 0.52%Apr 17, 2025
- High7.6An issue in a-blogcms 3.1.15 allows a remote attacker to obtain sensitive information via the /bid/1/admin/entry-edit/ path.Check if you run itEPSS 0.44%Apr 17, 2025
- High7.6An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function.Check if you run itEPSS 0.38%Apr 17, 2025
- High7.6An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function.Check if you run itEPSS 0.45%Apr 17, 2025
- High7.6An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function.Check if you run itEPSS 0.45%Apr 17, 2025
Sort