Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in all versions up to and including 0.9.14.Check if you run itEPSS 0.25%May 22, 2026
- Medium4.3The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing capability checks on the 'ultp_install_callback'…Check if you run itEPSS 0.23%May 22, 2026
- Critical9.2An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel panic.Check if you run itEPSS 0.29%May 22, 2026
- Medium6.9Mothra would respect a default value given by a website for HTML file upload forms.Check if you run itEPSS 0.28%May 22, 2026
- High7.5The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1.5.1.Check if you run itEPSS 0.27%May 22, 2026
- Medium5.3For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.Check if you run itEPSS 0.41%May 22, 2026
- High7.5An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.Check if you run itEPSS 0.47%May 22, 2026
- Critical10.0Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the…Check if you run itEPSS 0.56%May 22, 2026
- Critical9.1Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.Check if you run itEPSS 6.91%May 22, 2026
- Medium5.3SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.Check if you run itEPSS 0.50%May 22, 2026
- Critical9.1When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin…Check if you run itEPSS 0.60%May 22, 2026
- Critical9.1The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it.Check if you run itEPSS 0.47%May 22, 2026
- Critical9.1When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request.Check if you run itEPSS 0.68%May 22, 2026
- Critical9.1The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag.Check if you run itEPSS 0.48%May 22, 2026
- Critical9.1A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.Check if you run itEPSS 0.68%May 22, 2026
- High7.5The RSA and DSA public key parsers did not enforce size limits on key parameters.Check if you run itEPSS 0.47%May 22, 2026
- Medium6.3When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certi…Check if you run itEPSS 0.37%May 22, 2026
- Medium6.5An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process an…Check if you run itEPSS 0.28%May 22, 2026
- Critical9.6The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.Check if you run itEPSS 1.83%May 22, 2026
- Critical9.3A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciously c…Check if you run itEPSS 0.23%May 22, 2026
- High7.7A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlyin…Check if you run itEPSS 0.68%May 22, 2026
- Critical9.1A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.Check if you run itEPSS 1.25%May 22, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion().Check if you run itEPSS 0.11%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple().Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan().Check if you run itEPSS 0.13%May 21, 2026
Sort