Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.8libexpat before 2.8.4 lacks handler call depth tracking with custom encoding callbacks.Check if you run itEPSS 0.11%Aug 20, 2026
- High7.5In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation of getentropy's return code leads to insufficient entropy, which results in being vulnerable to hash flooding attacks, cCheck if you run itEPSS 0.29%Aug 20, 2026
- Medium5.7Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter.Check if you run itEPSS 0.50%Aug 20, 2026
- UnknownSPIP SPIP Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 2.29%Aug 20, 2026
- UnknownVeronaLabs wp_statistics Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.65%Aug 20, 2026
- High8.7Akaunting 3.1.21 contains an authenticated improper authorization vulnerability in the common BulkActions dispatcher.This issue affects Akaunting: 3.1.21.Check if you run itEPSS 0.30%Aug 19, 2026
- Critical9.3FFmpeg before commit 1c10bcc contains a heap buffer overflow in the RIST protocol reader (libavformat/librist.c).Check if you run itEPSS 0.70%Aug 19, 2026
- Medium6.5Cisco Unified Intelligence Center SQL Injection VulnerabilityCheck if you run itEPSS 0.35%Aug 19, 2026
- Medium4.8CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface di…Check if you run itEPSS 0.43%Aug 19, 2026
- Medium5.1HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users.Check if you run itEPSS 0.40%Aug 19, 2026
- Medium5.7In Eclipse OpenJ9 versions up to 0.60, a crafted .class file with deeply nested annotations causes a segmentation fault.Check if you run itEPSS 0.30%Aug 19, 2026
- High7.1AIL Framework contains a server-side request forgery (SSRF) vulnerability in its crawler submission functionality.Check if you run itEPSS 0.40%Aug 19, 2026
- Critical9.3Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel VulnerabilityPatch nowKEVEPSS 32.65%Aug 19, 2026
- Medium5.3The Membership For WooCommerce WordPress plugin before 3.1.2 does not check that an API consumer secret has actually been generated before comparing it against the one…Check if you run itEPSS 0.32%Aug 19, 2026
- Low2.7The Easy Appointments WordPress plugin before 4.0.1 does not restrict one of its appointment-listing REST endpoints to the records belonging to the requesting user, al…Check if you run itEPSS 0.32%Aug 19, 2026
- High7.1The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrat…Check if you run itEPSS 0.25%Aug 19, 2026
- High7.1The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public page…Check if you run itEPSS 0.25%Aug 19, 2026
- Medium6.8The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the uploa…Check if you run itEPSS 0.43%Aug 19, 2026
- High8.8The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing…Check if you run itEPSS 0.51%Aug 19, 2026
- High8.6The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-move operation reachable by unauthenticated users, allowing them to re…Check if you run itEPSS 0.73%Aug 19, 2026
- High7.1The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pag…Check if you run itEPSS 0.25%Aug 19, 2026
- Medium5.3The YayCurrency WordPress plugin before 3.3.5 does not perform any capability or ownership check on several of its multi-vendor integration handlers that are reachable…Check if you run itEPSS 0.32%Aug 19, 2026
- Medium6.8The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library l…Check if you run itEPSS 0.43%Aug 19, 2026
- High7.5The User Verification by PickPlugins WordPress plugin through 2.0.47 does not verify that a request to resend a verification email is authorized to act on the supplied…Check if you run itEPSS 0.44%Aug 19, 2026
- Low2.7The Quiz and Survey Master (QSM) WordPress plugin before 11.2.4 does not perform a per-object ownership check on the REST routes that return a quiz's email-notificatio…Check if you run itEPSS 0.30%Aug 19, 2026
Sort