Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Low3.7Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems.EPSS 0.2%Oct 16, 2026
- High8.1Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved.EPSS 0.3%Oct 16, 2026
- High8.6Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development.EPSS 0.3%Oct 16, 2026
- High8.1Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=).EPSS 0.3%Oct 16, 2026
- Critical9.8Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to i…EPSS 0.3%Oct 16, 2026
- Medium6.5Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-…EPSS 0.2%Oct 16, 2026
- Medium5.3Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags.EPSS 0.2%Oct 16, 2026
- High7.2The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter…EPSS 0.3%Oct 16, 2026
- High7.2The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…EPSS 0.3%Oct 16, 2026
- High7.2The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.0.390 du…EPSS 0.4%Oct 16, 2026
- Medium5.9The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter.EPSS 0.8%Oct 16, 2026
- High8.1The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the parameter in versions up to, and including, 3.3.0.EPSS 0.5%Oct 16, 2026
- Medium4.9The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].EPSS 0.4%Oct 16, 2026
- Medium4.8A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52.EPSS 0.1%Oct 16, 2026
- Low0.9A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0.EPSS 0.1%Oct 16, 2026
- High8.6A hard-coded cryptographic key vulnerability exists in the of some of Moxa's industrial computing products.EPSS 0.2%Oct 16, 2026
- Medium6.9A missing authorization vulnerability exists in the internal API of some of Moxa's industrial computing products.EPSS 0.1%Oct 16, 2026
- Medium4.8The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2.EPSS 0.3%Oct 16, 2026
- High7.0ISPSoft Out-of-Bounds Read VulnerabilityEPSS 0.3%Oct 16, 2026
- High7.0ISPSoft Out-of-Bounds Read VulnerabilityEPSS 0.3%Oct 16, 2026
- High8.3Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing ValidationEPSS 0.2%Oct 16, 2026
- Medium5.3Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth AuthenticationEPSS 0.2%Oct 16, 2026
- High7.1Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List EndpointEPSS 0.3%Oct 16, 2026
- Medium5.3Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfigEPSS 0.2%Oct 16, 2026
- Medium6.3Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer ToolsEPSS 0.2%Oct 16, 2026