Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low2.3Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying…Check if you run itEPSS 0.33%Oct 14, 2026
- Medium5.3ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the ser…Check if you run itEPSS 0.30%Oct 14, 2026
- Critical9.3office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf(…Check if you run itEPSS 3.04%Oct 14, 2026
- UnknownSecurity update for google-osconfig-agentOpen the advisoryOct 14, 2026
- High8.4A flaw was found in gst-plugins-base.Check if you run itEPSS 0.21%Oct 14, 2026
- Medium6.1A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux).Check if you run itEPSS 0.15%Oct 14, 2026
- High8.8Koha is vulnerable to OS command injection in the Task Scheduler deletion path.Check if you run itEPSS 1.61%Oct 14, 2026
- Critical9.8The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escalation in all versions up to,…Check if you run itEPSS 0.65%Oct 14, 2026
- Medium5.3The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing una…Check if you run itEPSS 0.31%Oct 14, 2026
- Medium4.9The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, allowing users with the Contr…Check if you run itEPSS 0.25%Oct 14, 2026
- Medium5.3The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result…Check if you run itEPSS 0.24%Oct 14, 2026
- High7.2The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plu…Check if you run itEPSS 0.31%Oct 14, 2026
- Medium5.3The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter.Check if you run itEPSS 0.28%Oct 14, 2026
- UnknownMalicious code in @flexmr/utils (npm)Open the advisoryOct 14, 2026
- High8.2Metalama allows local code execution through DLL planting in shared temporary directoriesOpen the advisoryOct 14, 2026
- UnknownCacti Authenticated Remote Code Execution via Host Variable InjectionPatch nowKEVOct 14, 2026
- UnknownModerate: environment-modules security updateOpen the advisoryOct 14, 2026
- High7.4Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing VulnerabilityCheck if you run itEPSS 0.58%Oct 13, 2026
- Critical9.8Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated SQL Injection via Guest Persistent Cart meta_valuePatch nowKEVEPSS 0.45%Oct 13, 2026
- Medium5.3Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check N…Check if you run itEPSS 0.25%Oct 13, 2026
- High7.0KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into theCheck if you run itEPSS 1.02%Oct 13, 2026
- High8.4Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands by crafting malicious file names.Check if you run itEPSS 1.15%Oct 13, 2026
- Low2.7Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbCheck if you run itEPSS 0.30%Oct 13, 2026
- Medium5.3Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation resul…Check if you run itEPSS 0.34%Oct 13, 2026
- Low3.3A flaw was found in device-mapper-persistent-data.Check if you run itEPSS 0.14%Oct 13, 2026