Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.4Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package.Check if you run itEPSS 0.92%Apr 17, 2026
- Medium6.5Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which can be used to compromise the device.Check if you run itEPSS 0.31%Apr 17, 2026
- High7.8OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private an…Check if you run itEPSS 0.29%Apr 17, 2026
- High8.8The WP Customer Area plugin for WordPress is vulnerable to arbitrary file read and deletion due to insufficient file path validation in the 'ajax_attach_file' function…Check if you run itEPSS 1.23%Apr 17, 2026
- Medium6.7A vulnerability allowing a local attacker with administrator privileges to bypass Windows Driver Signature Enforcement.Check if you run itEPSS 0.17%Apr 17, 2026
- Medium5.5A weakness has been identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593.Check if you run itEPSS 0.41%Apr 17, 2026
- Low2.1A security flaw has been discovered in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593.Check if you run itEPSS 0.35%Apr 17, 2026
- Low2.1A vulnerability was identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593.Check if you run itEPSS 0.32%Apr 17, 2026
- Medium4.4The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1.Check if you run itEPSS 0.31%Apr 17, 2026
- Medium5.1A path traversal vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to access higher-level directories that shoul…Check if you run itEPSS 0.44%Apr 17, 2026
- High8.6An OS command injection vulnerability exists in CubeCart prior to 6.6.0, which may allow a user with an administrative privilege to execute an arbitrary OS command.Check if you run itEPSS 1.20%Apr 17, 2026
- Medium6.5The Tutor LMS plugin for WordPress is vulnerable to SQL Injection in versions up to and including 3.9.8.Check if you run itEPSS 0.47%Apr 17, 2026
- Medium4.9The JetBackup – Backup, Restore & Migrate plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary Directory Deletion in versions up to and including 3.1.19.8.Check if you run itEPSS 0.60%Apr 17, 2026
- Medium4.9The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate', 'username_search', and 'useremail_search' para…Check if you run itEPSS 0.51%Apr 17, 2026
- Medium6.5The wpForo Forum plugin for WordPress is vulnerable to unauthorized modification of data due to the use of on user-controlled input in the method of in all versions up…Check if you run itEPSS 0.45%Apr 17, 2026
- Medium6.5The WP Statistics plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 14.16.4.Check if you run itEPSS 0.44%Apr 17, 2026
- Medium5.3SiYuan is an open-source personal knowledge management system.Check if you run itEPSS 0.38%Apr 17, 2026
- High7.2The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_source' parameter in all versions up to, and including, 14.16.4.Patch nowKEVEPSS 0.42%Apr 17, 2026
- Medium4.9Valtimo is an open-source business process automation platform.Check if you run itEPSS 0.48%Apr 16, 2026
- Medium5.9A missing lock verification in AMD Secure Processor (ASP) firmware may permit a locally authenticated attacker with administrative privileges to alter MMIO routing on…Check if you run itEPSS 0.11%Apr 16, 2026
- High8.7A privilege escalation vulnerability in Microchip IStaX allows an authenticated low-privileged user to recover a shared per-device cookie secret from their own webstax…Check if you run itEPSS 0.23%Apr 16, 2026
- High8.8The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to, and including, 1.6.Check if you run itEPSS 0.41%Apr 16, 2026
- Medium4.4The OPEN-BRAIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'API Key' settings field in all versions up to, and including, 0.5.0.Check if you run itEPSS 0.39%Apr 16, 2026
- High8.8The Livemesh Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.0.Check if you run itEPSS 0.82%Apr 16, 2026
- Medium6.4The Livemesh Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting via plugin settings in all ve…Check if you run itEPSS 0.32%Apr 16, 2026