Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7Joomla com_fabrik 3.9.11 contains a directory traversal vulnerability that allows unauthenticated attackers to list arbitrary files by manipulating the folder parameter.Check if you run itEPSS 0.72%May 13, 2026
- High8.8Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated attackers to execute arbitrary SQL queries by injec…Check if you run itEPSS 0.27%May 13, 2026
- Medium5.1Easy2Pilot 7 contains a cross-site request forgery vulnerability that allows attackers to add unauthorized user accounts by tricking authenticated administrators into…Check if you run itEPSS 0.14%May 13, 2026
- Medium4.8WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by…Check if you run itEPSS 0.26%May 13, 2026
- Medium6.8WordPress Plugin ultimate-member 2.1.3 contains a local file inclusion vulnerability that allows authenticated attackers to include arbitrary files by manipulating the…Check if you run itEPSS 0.25%May 13, 2026
- Critical9.3Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key used for…Check if you run itEPSS 0.25%May 13, 2026
- Medium5.3Crypt::Argon2 versions from 0.017 before 0.031 for Perl perform a heap out-of-bounds read in argon2_verify on empty encoded input.Check if you run itEPSS 0.33%May 13, 2026
- Medium6.0Improper Input Validation in the NAT64 translator in The OpenThread Authors OpenThread before commit 26a882d on all platforms allows an attacker on the adjacent IPv4 n…Check if you run itEPSS 0.16%May 13, 2026
- High7.1The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the pm_invite_us…Check if you run itEPSS 0.22%May 13, 2026
- Medium6.5The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind SQL Injection via the 'rid' parameter in all versions up to, and in…Check if you run itEPSS 0.27%May 13, 2026
- Medium4.3The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.8.4.Check if you run itEPSS 0.23%May 13, 2026
- High8.7Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion.Check if you run itEPSS 0.64%May 13, 2026
- High8.7Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion.Check if you run itEPSS 0.64%May 13, 2026
- High7.3An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allows attackers to execute arbitrary code via uploa…Check if you run itEPSS 0.28%May 13, 2026
- Medium6.5qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file.Check if you run itEPSS 0.27%May 13, 2026
- Medium6.5qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file.Check if you run itEPSS 0.21%May 13, 2026
- High7.2The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.5.4.Check if you run itEPSS 0.49%May 13, 2026
- Medium5.1ELECOM wireless LAN access point devices implement CSRF protection mechanism, but with inadequate handling of CSRF tokens.Check if you run itEPSS 0.19%May 13, 2026
- Medium5.1ELECOM wireless LAN access point devices do not check if language parameter has an appropriate value.Check if you run itEPSS 0.21%May 13, 2026
- Medium4.8Stored cross-site scripting vulnerability exists in ELECOM wireless LAN access point devices.Check if you run itEPSS 0.16%May 13, 2026
- Critical9.3ELECOM wireless LAN access point devices contain an OS command injection in processing of username parameter.Check if you run itEPSS 1.63%May 13, 2026
- Critical9.3ELECOM wireless LAN access point devices do not require authentication to access some specific URLs.Check if you run itEPSS 0.49%May 13, 2026
- Medium4.3The RTMKit Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the save_widget() and reset…Check if you run itEPSS 0.29%May 13, 2026
- High8.8The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.0.2 via the 'path' parameter of the…Check if you run itEPSS 0.63%May 13, 2026
- High8.6ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter.Check if you run itEPSS 1.31%May 13, 2026
Sort