Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.4Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to trigger builds and obtain information abouCheck if you run itEPSS 0.26%Oct 29, 2025
- High7.5Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a uCheck if you run itEPSS 0.47%Oct 29, 2025
- Medium4.3The Call Now Button – The #1 Click to Call Button for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple funcCheck if you run itEPSS 0.27%Oct 29, 2025
- Medium4.9The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to insufficient escapiCheck if you run itEPSS 0.30%Oct 29, 2025
- Medium5.3Missing Authorization vulnerability in StylemixThemes Masterstudy Elementor Widgets masterstudy-elementor-widgets allows Accessing Functionality Not Properly Constrained by ACLs.ThCheck if you run itEPSS 0.22%Oct 29, 2025
- Medium5.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizerCheck if you run itEPSS 0.18%Oct 29, 2025
- Medium5.3Missing Authorization vulnerability in solwin Blog Designer PRO blog-designer-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blog Designer PCheck if you run itEPSS 0.27%Oct 29, 2025
- Medium6.5The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce.Check if you run itEPSS 0.22%Oct 29, 2025
- Critical9.8A vulnerability was found in code-projects Online Complaint Site 1.0.Check if you run itEPSS 0.35%Oct 29, 2025
- Medium5.8An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attacker to cause the server to issue HTTP reCheck if you run itEPSS 0.29%Oct 29, 2025
- Medium6.7memoQ 10.1.13.ef1b2b52aae and earlier contains an unquoted service path vulnerability in the memoQ Auto Update Service (memoQauhlp101).Check if you run itEPSS 0.14%Oct 29, 2025
- Low3.0The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client that has the correct values of AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSICheck if you run itEPSS 0.38%Oct 29, 2025
- Medium6.5anti-malware_security_and_brute-force_firewall_project anti-malware_security_and_brute-force_firewall Missing AuthorizationPatch nowKEVEPSS 0.46%Oct 29, 2025
- Critical9.3D-Link dns-343_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 9.81%Oct 29, 2025
- Low3.8GitHub Workflow Updater is a VS Code extension that automatically pins GitHub Actions to specific commits for enhanced security.Check if you run itEPSS 0.13%Oct 28, 2025
- High8.5HP ThinPro 8.1 System management application failed to verify user's true id.Check if you run itEPSS 0.27%Oct 28, 2025
- Critical9.1Taiga is an open source project management platform.Check if you run itEPSS 1.55%Oct 28, 2025
- High7.2Astro is a web framework that includes an image proxy.Check if you run itEPSS 0.35%Oct 28, 2025
- Medium6.3Sliver is a command and control framework that uses a custom Wireguard netstack.Check if you run itEPSS 0.29%Oct 28, 2025
- Medium5.1IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript codeCheck if you run itEPSS 0.48%Oct 28, 2025
- Medium5.1IPFire versions prior to 2.29 (Core Update 198) contain multiple stored cross-site scripting (XSS) vulnerabilities caused by a bug in the cleanhtml() function (/var/ipfire/header.pCheck if you run itEPSS 0.48%Oct 28, 2025
- Medium5.1IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript codeCheck if you run itEPSS 0.48%Oct 28, 2025
- Medium5.1IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript codeCheck if you run itEPSS 0.48%Oct 28, 2025
- Medium5.1IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript codeCheck if you run itEPSS 0.48%Oct 28, 2025
- Medium5.1IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript codeCheck if you run itEPSS 0.48%Oct 28, 2025
Sort