Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.14.10 via the AJAX action.Check this weekEPSS 37.00%Jan 9, 2026
- Medium5.3The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.15 via the REST API endpoint.Check this weekEPSS 35.00%Jan 9, 2026
- Medium6.5The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the scripts() function.Check this weekEPSS 36.00%Jan 9, 2026
- Critical9.8dynamiapps frontend_admin Improper Privilege ManagementPatch nowKEVEPSS 0.72%Jan 9, 2026
- High8.8Authlib is a Python library which builds OAuth and OpenID Connect servers.Check if you run itEPSS 0.27%Jan 8, 2026
- Medium5.4Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.ThiCheck if you run itEPSS 0.20%Jan 8, 2026
- Medium6.6CoreDNS is a DNS server that chains plugins.Check if you run itEPSS 0.49%Jan 8, 2026
- High8.5OpenMetadata is a unified metadata platform.Check if you run itEPSS 1.29%Jan 8, 2026
- Critical9.3The OWASP core rule set (CRS) is a set of generic attack detection rules for use with compatible web application firewalls.Check this weekEPSS 17.88%Jan 8, 2026
- Medium5.3When doing TLS related transfers with reused easy or multi handles and altering the option, libcurl could accidentally reuse a CA store cached in memory for which the partial chainCheck if you run itEPSS 0.76%Jan 8, 2026
- Medium5.9When using option with libcurl or with the curl tool, curl should check the public key of the server certificate to verify the peer.Check if you run itEPSS 0.24%Jan 8, 2026
- Medium4.3Missing Authorization vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels.Check if you run itEPSS 0.22%Jan 8, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus@hotmail.com Scroll rss excerpt scroll-rss-excerpt allows Reflected XSCheck if you run itEPSS 0.18%Jan 8, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anibalwainstein Effect Maker effect-maker allows DOM-Based XSS.This issue affeCheck if you run itEPSS 0.19%Jan 8, 2026
- High7.5Insertion of Sensitive Information Into Sent Data vulnerability in AITpro BulletProof Security bulletproof-security allows Retrieve Embedded Sensitive Data.This issue affects BulleCheck if you run itEPSS 0.29%Jan 8, 2026
- High8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VanKarWai Lobo lobo allows Blind SQL Injection.This issue affects Lobo: from nCheck this weekEPSS 30.00%Jan 8, 2026
- Medium6.5Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ArubaCheck this weekEPSS 29.00%Jan 8, 2026
- High7.5Missing Authorization vulnerability in Kaira Blockons blockons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockons: from n/a through <= 1.2.Check this weekEPSS 34.00%Jan 8, 2026
- High7.5Missing Authorization vulnerability in sizam REHub Framework rehub-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects REHub Framework: froCheck this weekEPSS 34.00%Jan 8, 2026
- Low2.0A vulnerability was identified in code-projects Intern Membership Management System 1.0.Check if you run itEPSS 0.37%Jan 8, 2026
- Medium6.5The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_order_by_id() fuCheck this weekEPSS 24.00%Jan 8, 2026
- Medium6.4The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input sanitization in the coCheck this weekEPSS 23.00%Jan 8, 2026
- Medium5.3axllent mailpit Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 0.81%Jan 8, 2026
- Critical10.0n8n n8n Improper Input ValidationPatch nowKEVEPSS 78.19%Jan 8, 2026
- High7.5Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition.Check if you run itEPSS 0.61%Jan 8, 2026
Sort