Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.9Terminal Services Manager 3.2.1 contains a local buffer overflow vulnerability that allows attackers to crash the application by supplying an excessively long string i…Check if you run itEPSS 0.20%Mar 21, 2026
- Medium6.9Pidgin 2.13.0 contains a denial of service vulnerability that allows local attackers to crash the application by providing an excessively long username string during a…Check if you run itEPSS 0.19%Mar 21, 2026
- Low2.1A vulnerability was detected in vanna-ai vanna up to 2.0.2.Check if you run itEPSS 0.20%Mar 21, 2026
- Low2.1A security vulnerability has been detected in vanna-ai vanna up to 2.0.2.Check if you run itEPSS 0.24%Mar 21, 2026
- Low2.1A weakness has been identified in PbootCMS up to 3.2.12.Check if you run itEPSS 0.27%Mar 21, 2026
- High7.5The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2.Check if you run itEPSS 0.40%Mar 21, 2026
- Medium6.4The WordPress PayPal Donation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'donate' shortcode in all versions up to, and including, 1.01.Check if you run itEPSS 0.20%Mar 21, 2026
- Medium6.4The WP Games Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [game] shortcode in all versions up to and including 0.1beta.Check if you run itEPSS 0.24%Mar 21, 2026
- Medium5.3The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.23.Check if you run itEPSS 0.32%Mar 21, 2026
- Medium5.3The Punnel – Landing Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.1.Check if you run itEPSS 0.30%Mar 21, 2026
- Medium5.3The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the file.Check if you run itEPSS 1.14%Mar 21, 2026
- High8.8The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versions up t…Check if you run itEPSS 0.36%Mar 21, 2026
- Medium4.3The Xhanch - My Advanced Settings plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2.Check if you run itEPSS 0.14%Mar 21, 2026
- High8.8The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_repla…Check if you run itEPSS 0.31%Mar 21, 2026
- Medium6.5The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the AJAX action in all vers…Check if you run itEPSS 0.24%Mar 21, 2026
- Medium6.5The ElementCamp plugin for WordPress is vulnerable to time-based SQL Injection via the 'meta_query[compare]' parameter in the 'tcg_select2_search_post' AJAX action in…Check if you run itEPSS 0.25%Mar 21, 2026
- Medium6.1The itsukaita plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'day_from' and 'day_to' parameters in all versions up to, and including, 0.1…Check if you run itEPSS 0.27%Mar 21, 2026
- Medium6.5The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.10.Check if you run itEPSS 0.29%Mar 21, 2026
- Medium6.5The Task Manager plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.0.2 via the callback_get_text_from_url() function.Check if you run itEPSS 0.26%Mar 21, 2026
- Medium6.4The FuseDesk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's fusedesk_newcase shortcode in all versions up to, and including, 6.8 du…Check if you run itEPSS 0.19%Mar 21, 2026
- High7.2The Performance Monitor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.6.Check if you run itEPSS 0.39%Mar 21, 2026
- Medium5.3OpenClaw versions prior to 2026.2.25 fail to consistently apply sender-policy checks to reaction_* and pin_* non-message events before adding them to system-event context.Check if you run itEPSS 0.21%Mar 21, 2026
- Medium5.3OpenClaw versions prior to 2026.2.23 contain an authorization bypass vulnerability in the ACP client that auto-approves tool calls based on untrusted toolCall.kind met…Check if you run itEPSS 0.26%Mar 21, 2026
- Medium6.3OpenClaw versions prior to 2026.2.22 reuse gateway.auth.token as a fallback hash secret for owner-ID prompt obfuscation when commands.ownerDisplay is set to hash and c…Check if you run itEPSS 0.27%Mar 21, 2026
- Medium6.3The BlueBubbles webhook handler in OpenClaw versions prior to 2026.2.21 contains a passwordless fallback authentication path that allows unauthenticated webhook events…Check if you run itEPSS 0.25%Mar 21, 2026
Sort