Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7Woocommerce CSV Importer 3.3.6 contains a path traversal vulnerability that allows any registered user to delete arbitrary files by submitting unescaped filenames thro…Check if you run itEPSS 0.61%May 17, 2026
- Medium5.3TP-Link TL-WR720N wireless router contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized administrative actions by crafting…Check if you run itEPSS 0.18%May 17, 2026
- High7.1Redaxo CMS Addon MyEvents 2.2.1 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code throug…Check if you run itEPSS 0.27%May 17, 2026
- Low0.9A security flaw has been discovered in Oinone Pamirs up to 7.2.0.Check if you run itEPSS 0.21%May 17, 2026
- Medium5.5A weakness has been identified in CoreWorxLab CAAL up to 1.6.0.Check if you run itEPSS 0.51%May 17, 2026
- Medium6.3### Summary throws when called with and on an array containing or .Check if you run itEPSS 0.42%May 17, 2026
- UnknownAsusWRT 'handle_request' Function Authentication BypassPatch nowKEVEPSS 87.64%May 17, 2026
- High7.1Fuel CMS 1.4.13 contains a blind SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the 'col'…Check if you run itEPSS 0.23%May 16, 2026
- High8.7WordPress Plugin Backup and Restore 1.0.3 contains an arbitrary file deletion vulnerability that allows authenticated attackers to delete files by manipulating paramet…Check if you run itEPSS 0.40%May 16, 2026
- Medium6.9ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation.Check if you run itEPSS 0.78%May 16, 2026
- High8.7WordPress Plugin Anti-Malware Security and Bruteforce Firewall 4.20.59 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbit…Check if you run itEPSS 0.65%May 16, 2026
- Medium5.1WP Learn Manager 1.1.2 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts through the parameter.Check if you run itEPSS 0.21%May 16, 2026
- High8.8EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through th…Check if you run itEPSS 0.28%May 16, 2026
- High8.8LayerBB 1.1.4 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the search_query parameter.Check if you run itEPSS 0.24%May 16, 2026
- Medium6.9MyBB Timeline Plugin 1.0 contains cross-site scripting vulnerabilities that allow attackers to inject malicious scripts through thread titles, post content, and user p…Check if you run itEPSS 0.23%May 16, 2026
- Medium6.9Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the downl…Check if you run itEPSS 0.67%May 16, 2026
- High8.8Supsystic Membership 1.4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code t…Check if you run itEPSS 0.28%May 16, 2026
- High8.8Supsystic Ultimate Maps 1.1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious co…Check if you run itEPSS 0.28%May 16, 2026
- Medium6.9bloofoxCMS 0.5.2.1 contains a cross-site request forgery vulnerability that allows attackers to perform administrative actions by tricking logged-in users into visitin…Check if you run itEPSS 0.15%May 16, 2026
- Critical9.3iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass authentication by requesting the autoLoginVerifyCode object.Check if you run itEPSS 0.43%May 16, 2026
- High8.7HS Brand Logo Slider 2.1 contains an unrestricted file upload vulnerability that allows authenticated users to bypass client-side file extension validation by uploadin…Check if you run itEPSS 0.54%May 16, 2026
- Medium5.3The Essential Chat Support plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.1.Check if you run itEPSS 0.43%May 16, 2026
- Unknownwelaunch wordpress_country_selector Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 1.40%May 16, 2026
- Medium6.5Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.43%May 15, 2026
- Medium6.5Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.39%May 15, 2026