Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.1WordPress Core Remote File Inclusion VulnerabilityPatch nowKEVEPSS 95.77%Sep 22, 2026
- UnknownUnrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.43%Sep 22, 2026
- Unknownpixelite events_manager Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.25%Sep 22, 2026
- UnknownImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')Patch nowKEVEPSS 0.39%Sep 22, 2026
- Medium5.3The default AEAD nonce provider for the PSA Internal Trusted Storage transform module, secure_storage_its_transform_aead_get_nonce() in subsys/secure_storage/src/its/t…Check if you run itEPSS 0.08%Sep 21, 2026
- High7.5A flaw was found in the SmallRye Fault Tolerance library, which is used by Quarkus to provide strategies like retries and circuit breakers for microservices.Check if you run itEPSS 0.63%Sep 21, 2026
- Medium5.3A stack-based buffer overflow flaw was found in fetchmail when built with NTLM support.Check if you run itEPSS 1.20%Sep 21, 2026
- High8.1A flaw was found in pki-core.Check if you run itEPSS 0.21%Sep 21, 2026
- High8.6UVdesk core-framework before 1.1.7 contains an improper privilege management vulnerability in the editAgent endpoint that allows agents with agent-management privilege…Check if you run itEPSS 0.64%Sep 21, 2026
- Medium5.3UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restri…Check if you run itEPSS 0.42%Sep 21, 2026
- Medium5.1UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfig…Check if you run itEPSS 0.32%Sep 21, 2026
- Low2.1A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX.Check if you run itEPSS 0.45%Sep 21, 2026
- Low2.1A vulnerability was found in ST Engineering iDirect iDX and Evo iDX.Check if you run itEPSS 0.43%Sep 21, 2026
- Critical9.1UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Pr…Check if you run itEPSS 0.33%Sep 21, 2026
- Medium6.5givewp givewp Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Patch nowKEVEPSS 0.31%Sep 21, 2026
- Unknownincsub forminator Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 0.73%Sep 21, 2026
- UnknownImproper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 1.42%Sep 21, 2026
- UnknownUnrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.45%Sep 21, 2026
- UnknownThemefic ultimate_addons_for_contact_form_7 Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 4.33%Sep 21, 2026
- Unknowniguazio nuclio Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 7.52%Sep 21, 2026
- UnknownFlowiseAI Flowise Use of Hard-coded Cryptographic KeyPatch nowKEVEPSS 0.66%Sep 21, 2026
- UnknownImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')Patch nowKEVEPSS 1.16%Sep 21, 2026
- High7.5Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted.Check if you run itEPSS 0.40%Sep 19, 2026
- Low2.3hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped StringsCheck if you run itEPSS 0.23%Sep 19, 2026
- Low3.5The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per…Check if you run itEPSS 0.24%Sep 19, 2026
Sort