Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8Missing Authorization vulnerability in ThimPress Thim Core thim-core.This issue affects Thim Core: from n/a through 2.3.3.Check if you run itEPSS 0.24%Jun 2, 2026
- Medium5.3Missing Authorization vulnerability in Anton Shevchuk Constructor allows Accessing Functionality Not Properly Constrained by ACLs.Check if you run itEPSS 0.19%Jun 2, 2026
- Critical9.8Incorrect Privilege Assignment vulnerability in Themeisle Masteriyo LMS PRO allows Privilege Escalation.Check if you run itEPSS 0.27%Jun 2, 2026
- Medium6.5Missing Authorization vulnerability in Printeers Printeers Print & Ship allows Exploiting Incorrectly Configured Access Control Security Levels.Check if you run itEPSS 0.17%Jun 2, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnboundStudio Accordion FAQ allows Reflected XSS.Check if you run itEPSS 0.15%Jun 2, 2026
- Medium4.3The Remove NoFollow Commenter URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.Check if you run itEPSS 0.13%Jun 2, 2026
- Medium4.3The Google Plus One Bottom plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.0.2.Check if you run itEPSS 0.13%Jun 2, 2026
- Medium4.3The Laiser Tag plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.5.Check if you run itEPSS 0.13%Jun 2, 2026
- Medium4.3The Tectite Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.Check if you run itEPSS 0.13%Jun 2, 2026
- Medium4.3The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.4.1.Check if you run itEPSS 0.20%Jun 2, 2026
- Medium6.4The DeMomentSomTres Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'callout' shortcode in all versions up to, and including, 1.1.1.Check if you run itEPSS 0.18%Jun 2, 2026
- Medium4.3The Remove meta boxes per user role plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.01.Check if you run itEPSS 0.13%Jun 2, 2026
- Medium6.4The ZeM STL plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the [zemstl] shortcode in all versions up to and including 1.0.Check if you run itEPSS 0.24%Jun 2, 2026
- Medium6.4The Easy Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'add_to_cart' shortcode in all versions up to and including 1.8.Check if you run itEPSS 0.24%Jun 2, 2026
- Medium4.3The BirdSeed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.0.Check if you run itEPSS 0.13%Jun 2, 2026
- Medium4.4The Word Replacer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replacement' parameter in all versions up to, and including, 0.4.Check if you run itEPSS 0.25%Jun 2, 2026
- High7.5In version 3.6.19 of prefecthq/prefect, an authentication bypass vulnerability exists due to the improper handling of URL path exemptions for health check probes.Check if you run itEPSS 0.48%Jun 2, 2026
- Medium6.1The hiWeb Migration Simple plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'new_domain' parameter in all versions up to, and including, 2.…Check if you run itEPSS 0.21%Jun 2, 2026
- Medium6.4The FPW Category Thumbnails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'fpw_fs_get_file' AJAX action in all versio…Check if you run itEPSS 0.19%Jun 2, 2026
- High8.8The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy.Check if you run itEPSS 0.19%Jun 2, 2026
- Medium6.1The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'a' parameter in versions up to, and including, 0.6.2 due to insufficient inpu…Check if you run itEPSS 0.21%Jun 2, 2026
- Medium6.1The rognone plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'mode' parameter in versions up to, and including, 0.6.2 due to insufficient i…Check if you run itEPSS 0.20%Jun 2, 2026
- Medium5.5The WP Nano AD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘blogrole_link’ parameter in all versions up to, and including, 1.31 due to in…Check if you run itEPSS 0.20%Jun 2, 2026
- High7.5The Really Simple Security WordPress plugin before 9.5.10.1 does not enforce the second-factor challenge in two of its two-factor authentication REST endpoints, allowi…Check if you run itEPSS 0.24%Jun 2, 2026
- Medium6.5MLflow 3.9.0 with basic-auth ( ) fails to enforce authorization checks for multiple Gateway API 'list' endpoints.Check if you run itEPSS 0.24%Jun 2, 2026
Sort