Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.9ELECOM wireless LAN access point devices use a hard-coded cryptographic key when creating backups of configuration files.Check if you run itEPSS 0.12%May 13, 2026
- Medium5.3Successfully using libcurl to do a transfer over a specific HTTP proxy ( ) with **Digest** authentication and then changing the proxy host to a second one ( ) for a second transferCheck if you run itEPSS 0.47%May 13, 2026
- Medium5.3When curl is told to use the Certificate Status Request TLS extension, often referred to as *OCSP stapling*, to verify that the server certificate is valid, it fails t…Check if you run itEPSS 0.27%May 13, 2026
- Medium5.3When asked to both use a file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first host to the followed-to host under certain circumstanCheck if you run itEPSS 0.52%May 13, 2026
- High7.5Using libcurl, when a custom header is first set for an HTTP request and a second request is subsequently done using the same *easy handle* but without the custom header set, the sCheck if you run itEPSS 0.29%May 13, 2026
- Medium5.9curl might erroneously pass on credentials for a first proxy to a second proxy.Check if you run itEPSS 0.72%May 13, 2026
- High7.5libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers.Check if you run itEPSS 0.62%May 13, 2026
- Medium6.5libcurl might in some circumstances reuse the wrong connection when asked to do an authenticated HTTP(S) request after a Negotiate-authenticated one, when both use the same host.Check if you run itEPSS 0.41%May 13, 2026
- Medium5.9A vulnerability exists where a connection requiring TLS incorrectly reuses an existing unencrypted connection from the same connection pool.Check if you run itEPSS 0.33%May 13, 2026
- High7.5theme-fusion avada_builder Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 0.51%May 13, 2026
- Medium6.5The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' function wi…Check if you run itEPSS 0.47%May 13, 2026
- Medium5.1The newly introduced RecordUsage D-Bus method https://gitlab.freedesktop.org/pwithnall/malcontent/-/blob/0.14.0/libmalcontent-timer/child-timer-service.c in malcontent…Check if you run itEPSS 0.15%May 13, 2026
- Medium5.1csync2 uses insecure temporary directories when compiled with C99 or later, allowing for TOCTOU style attacks on the temporary directories.Check if you run itEPSS 0.07%May 13, 2026
- Medium5.3The Hostinger Reach – AI-Powered Email Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability chec…Check if you run itEPSS 0.38%May 13, 2026
- High7.0The new upstream added a privileged D-Bus helper called plasmaloginauthhelper, which suffers from multiple issues, e.g.aA compromised plasmalogin service account can c…Check if you run itEPSS 0.13%May 13, 2026
- High7.8Palo Alto Networks PAN-OS Authentication Bypass VulnerabilityPatch nowKEVEPSS 95.01%May 13, 2026
- Medium5.2Privilege escalation in the mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) allows a local unprivileged user able to create a Windows…Check if you run itEPSS 0.12%May 13, 2026
- Critical9.9Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to rea…Check if you run itEPSS 0.39%May 13, 2026
- Medium6.4The Snow Monkey Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-slick' attribute in all versions up to, and including, 24.1.11 d…Check if you run itEPSS 0.19%May 13, 2026
- High8.4A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code…Check if you run itEPSS 0.37%May 13, 2026
- Medium5.5The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the shortcode in all versions up…Check if you run itEPSS 0.21%May 13, 2026
- Medium5.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 3.9.9.Check if you run itEPSS 0.30%May 13, 2026
- High7.5The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'sortf' parameter in al…Check if you run itEPSS 0.33%May 13, 2026
- High8.4Bytello Share (Windows Edition) installer executable provided by Bytello insecurely loads Dynamic Link Libraries.Check if you run itEPSS 0.12%May 13, 2026
- Medium6.0Incorrect authorization in the "submitted together" feature in Gerrit versions 2.12 and later allows an authenticated attacker with force push permissions on a seconda…Check if you run itEPSS 0.12%May 13, 2026
Sort