Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.4Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.Check this weekEPSS 21.00%Nov 18, 2025
- High7.0GoSign Desktop versions 2.4.0 and earlier use an unsigned update manifest for distributing application updates.Check this weekEPSS 11.00%Nov 18, 2025
- Medium5.3A flaw has been found in SourceCodester Train Station Ticketing System 1.0.Check this weekEPSS 33.00%Nov 18, 2025
- Medium5.3A vulnerability was detected in SourceCodester Train Station Ticketing System 1.0.Check this weekEPSS 33.00%Nov 18, 2025
- Medium6.8The AI Engine plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.8 via the rest_helpers_create_images function.Check if you run itEPSS 0.45%Nov 18, 2025
- Critical9.8A missing authentication enforcement vulnerability exists in the mutual TLS (mTLS) implementation used by System REST APIs and SOAP services in multiple WSO2 products.Check this weekEPSS 25.00%Nov 18, 2025
- Medium5.3A security vulnerability has been detected in SourceCodester Train Station Ticketing System 1.0.Check this weekEPSS 55.00%Nov 18, 2025
- Medium5.1Stored Cross-site Scripting (XSS)vylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an stored XSS of a stored XSS due to a lack of proper validation ofCheck if you run itEPSS 0.30%Nov 18, 2025
- Medium5.1Stored Cross-site Scripting (XSS)vylnerability type in WinPlus v24.11.27 byInformática del Este that consist of an stored XSS of a stored XSS due to a lack of proper validation ofCheck if you run itEPSS 0.37%Nov 18, 2025
- Medium5.8Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 0.50%Nov 18, 2025
- Critical9.3Faulty authorization control in software WinPlus v24.11.27 by Informática del Este that allows another user to be impersonated simply by knowing their 'numerical ID', meaning thatCheck if you run itEPSS 0.34%Nov 18, 2025
- Medium4.3The wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.2.2.Check if you run itEPSS 0.27%Nov 18, 2025
- Medium4.3The WP Duplicate Page plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.7.Check if you run itEPSS 0.25%Nov 18, 2025
- High7.5The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.39.Check if you run itEPSS 0.34%Nov 18, 2025
- Medium5.4The Broken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links plugin for WordPress is vulnerable to unauthorized post modification due to missing authorizationCheck if you run itEPSS 0.24%Nov 18, 2025
- Medium6.4The Local Syndication plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5a via the parameter in the shortcode.Check if you run itEPSS 0.25%Nov 18, 2025
- High8.0Android Security Bulletin—November 2025 | Android Open Source ProjectCheck if you run itEPSS 0.87%Nov 18, 2025
- Low2.4Missing Release of Resource after Effective Lifetime (CWE-772) in the T21 Reader allows an attacker with physical access to the Reader to perform a denial-of-service attack againstCheck if you run itEPSS 0.17%Nov 18, 2025
- High7.5An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker to perform Slowloris‑sCheck if you run itEPSS 0.34%Nov 18, 2025
- Medium6.1Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains andCheck this weekEPSS 23.00%Nov 18, 2025
- Medium6.5A command injection vulnerability exists in the MCP Data Science Server's (reading-plus-ai/mcp-server-data-exploration) 0.1.6 in the safe_eval() function (src/mcp_server_ds/server.Check this weekEPSS 86.00%Nov 18, 2025
- High7.3A vulnerability was discovered in Awesome Miner thru 11.2.4 that allows arbitrary read and write to kernel memory and MSRs (such as LSTAR) as an unprivileged user.Check this weekEPSS 28.00%Nov 18, 2025
- Medium6.5kishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the deleting doctor logic.Check this weekEPSS 26.00%Nov 18, 2025
- Medium5.1Local Agent DVR versions thru 6.6.1.0 are vulnerable to directory traversal that allows an unauthenticated local attacker to gain access to sensitive information, cause a server-siCheck this weekEPSS 43.00%Nov 18, 2025
- Critical9.8The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unauthenticated file upload vulnerability in the /upload_file.php endpoint.Check this weekEPSS 82.00%Nov 18, 2025
Sort