Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template parameter.Check if you run itEPSS 1.52%Jan 14, 2026
- Medium5.4The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm_get_email_recipients and wpcrm_system_ajax_task_change_staCheck this weekEPSS 25.00%Jan 14, 2026
- High7.2The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chat message field in all vCheck this weekEPSS 28.00%Jan 14, 2026
- Medium6.5The Gotham Block Extra Light plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.5.0 via the 'ghostban' shortcode.Check this weekEPSS 37.00%Jan 14, 2026
- Medium5.3The PDF Resume Parser plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.Check this weekEPSS 38.00%Jan 14, 2026
- Critical9.8The Integration Opvius AI for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.0.Check this weekEPSS 68.00%Jan 14, 2026
- Medium5.3The LottieFiles – Lottie block for Gutenberg plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.0 via the REST API endpoCheck this weekEPSS 93.00%Jan 14, 2026
- Medium4.6An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the UART port of the BK7231N controller (Wi-FCheck if you run itEPSS 0.18%Jan 14, 2026
- Medium6.1A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically proximate attacker to hijack the boot mechanism and gain a bootlCheck if you run itEPSS 0.21%Jan 14, 2026
- High8.8Social-Share-Buttons 2.2.3 contains a critical SQL injection vulnerability in the project_id parameter that allows attackers to manipulate database queries.Check this weekEPSS 30.00%Jan 13, 2026
- Medium5.1Jetpack 11.4 contains a cross-site scripting vulnerability in the contact form module that allows attackers to inject malicious scripts through the post_id parameter.Check if you run itEPSS 0.29%Jan 13, 2026
- Medium5.1Zstore, now referred to as Zippy CRM, 6.5.4 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts through unvalidated input paraCheck if you run itEPSS 0.29%Jan 13, 2026
- Medium5.1Testa 3.5.1 contains a reflected cross-site scripting vulnerability in the login.php redirect parameter that allows attackers to inject malicious scripts.Check if you run itEPSS 0.41%Jan 13, 2026
- High7.1VIAVIWEB Wallpaper Admin 1.0 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the img_id parCheck this weekEPSS 46.00%Jan 13, 2026
- Critical9.3VIAVIWEB Wallpaper Admin 1.0 contains an unauthenticated remote code execution vulnerability in the image upload functionality.Check this weekEPSS 99.00%Jan 13, 2026
- High8.8VIAVIWEB Wallpaper Admin 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating login credentials.Check this weekEPSS 69.00%Jan 13, 2026
- Medium5.1YouPHPTube <= 7.8 contains a cross-site scripting vulnerability that allows attackers to inject malicious scripts through the redirectUri parameter in the signup page.Check if you run itEPSS 0.36%Jan 13, 2026
- Medium5.1WPForms 1.7.8 contains a cross-site scripting vulnerability in the slider import search feature and tab parameter.Check if you run itEPSS 0.38%Jan 13, 2026
- High8.8WorkOrder CMS 0.1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login by manipulating username and password parameters.Check this weekEPSS 35.00%Jan 13, 2026
- High8.5Tftpd32 SE 4.60 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges.Check this weekEPSS 15.00%Jan 13, 2026
- Critical9.3eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request.Check if you run itEPSS 5.68%Jan 13, 2026
- Medium5.1AimOne Video Converter 2.04 Build 103 contains a buffer overflow vulnerability in its registration form that causes application crashes.Check if you run itEPSS 0.47%Jan 13, 2026
- High8.5Clevo HotKey Clipboard 2.1.0.6 contains an unquoted service path vulnerability in the HKClipSvc service that allows local non-privileged users to potentially execute code with systCheck this weekEPSS 22.00%Jan 13, 2026
- High8.6e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path traversal.Check if you run itEPSS 1.29%Jan 13, 2026
- Medium5.1Ametys CMS v4.4.1 contains a persistent cross-site scripting vulnerability in the link directory's input fields for external links.Check this weekEPSS 32.00%Jan 13, 2026
Sort