Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.1When safe filter is used with variable expansion, all following pipelines on the same string are incorrectly interpreted as safe too, enabling unsafe data to be unescaped.Check if you run itEPSS 0.41%May 12, 2026
- High7.3Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files.Check if you run itEPSS 0.20%May 12, 2026
- Medium4.7The consul-template library before version 0.42.0 is vulnerable to a sandbox path bypass in the file template helper that may allow reading an out-of-sandbox file.Check if you run itEPSS 0.15%May 12, 2026
- High8.7CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.Check if you run itEPSS 0.31%May 12, 2026
- High7.7Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Travel WP Travel wp-travel allows Blind SQL Injection.This iss…Check if you run itEPSS 0.22%May 12, 2026
- Medium5.3Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Retrieve Embedded Sensitive Data.This issue affects WP Easy…Check if you run itEPSS 0.20%May 12, 2026
- High8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Blind SQL…Check if you run itEPSS 0.22%May 12, 2026
- High7.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RealMag777 BEAR woo-bulk-editor allows Blind SQL Injection.This i…Check if you run itEPSS 0.23%May 12, 2026
- Medium5.3Missing Authorization vulnerability in Gabe Livan Asset CleanUp: Page Speed Booster wp-asset-clean-up allows Exploiting Incorrectly Configured Access Control Security…Check if you run itEPSS 0.22%May 12, 2026
- High8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Bli…Check if you run itEPSS 0.22%May 12, 2026
- Medium5.4Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec…Check if you run itEPSS 0.17%May 12, 2026
- High8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Views for WPForms views-for-wpforms-lite allows Blind SQL In…Check if you run itEPSS 0.22%May 12, 2026
- High8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aman Ninja Forms Views – Display & Edit Ninja Forms Submiss…Check if you run itEPSS 0.22%May 12, 2026
- High8.2A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way.Check if you run itEPSS 0.22%May 12, 2026
- High7.5Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.Check if you run itEPSS 0.26%May 12, 2026
- Low2.9The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications could obtain sensitive information.Check if you run itEPSS 0.09%May 12, 2026
- High8.8Incorrect Authorization vulnerability in E-Kalite Software Hardware Engineering Design and Internet Services Industry and Trade Ltd.Check if you run itEPSS 0.23%May 12, 2026
- High7.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception.Check if you run itEPSS 0.33%May 12, 2026
- High7.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception.Check if you run itEPSS 0.47%May 12, 2026
- High7.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via regular expression backtracking in the Content-Disposition filename parameter parser.Check if you run itEPSS 0.34%May 12, 2026
- Critical9.2Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board.Check if you run itEPSS 0.15%May 12, 2026
- Critical9.2Prior to 2025-11-03, well-intended users of Terraform or REST API for Google Cloud AlloyDB for PostgreSQL could have created clusters with an insecure default password…Check if you run itEPSS 0.24%May 12, 2026
- Medium4.4The Continually plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.3.1 due to insufficient in…Check if you run itEPSS 0.19%May 12, 2026
- Medium4.4The FastBots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.12 due to insufficient inpu…Check if you run itEPSS 0.19%May 12, 2026
- High8.8Authorization bypass through User-Controlled key vulnerability in ABIS Technology Ltd.Check if you run itEPSS 0.24%May 12, 2026
Sort