Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.4Active access tokens are not revoked or invalidated when a user account is locked within WSO2 Identity Server.Check if you run itEPSS 0.18%Apr 16, 2026
- Medium6.1The authentication endpoint fails to encode user-supplied input before rendering it in the web page, allowing for script injection.Check if you run itEPSS 0.23%Apr 16, 2026
- High7.5The component accepts XML input through the publisher without disabling external entity resolution.Check if you run itEPSS 0.27%Apr 16, 2026
- Medium5.4The WSO2 API Manager developer portal accepts user-supplied input without enforcing expected validation constraints or proper output encoding.Check if you run itEPSS 0.19%Apr 16, 2026
- Medium6.1The authentication endpoint fails to adequately validate user-supplied input before reflecting it back in the response.Check if you run itEPSS 0.24%Apr 16, 2026
- High7.3Dell Storage Manager - Replay Manager for Microsoft Servers, version(s) 8.0, contain(s) an Improper Privilege Management vulnerability.Check if you run itEPSS 0.12%Apr 16, 2026
- Critical9.1The XML parsers within multiple WSO2 products accept user-supplied XML data without properly configuring to prevent the resolution of external entities.Check if you run itEPSS 0.38%Apr 16, 2026
- Medium5.3The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capa…Check if you run itEPSS 0.28%Apr 16, 2026
- High8.8The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to, and including, 1.6.Check if you run itEPSS 0.41%Apr 16, 2026
- High7.8In rsync 3.0.1 through 3.4.1, receive_xattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free.Check if you run itEPSS 0.39%Apr 16, 2026
- Medium5.0ONLYOFFICE DocumentServer before 9.3.0 has an untrusted pointer dereference in XLS processing/conversion (via pictFmla.cbBufInCtlStm and other vectors), leading to an…Check if you run itEPSS 0.29%Apr 16, 2026
- Medium6.2In ONLYOFFICE DesktopEditors before 9.3.0, the update service allows attackers to perform actions on files with SYSTEM privileges.Check if you run itEPSS 0.16%Apr 16, 2026
- Medium4.4The OPEN-BRAIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'API Key' settings field in all versions up to, and including, 0.5.0.Check if you run itEPSS 0.34%Apr 16, 2026
- High7.2The Prismatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'prismatic_encoded' pseudo-shortcode in all versions up to, and including, 3.7.3.Check if you run itEPSS 0.27%Apr 16, 2026
- Medium6.4The BetterDocs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'betterdocs_feedback_form' shortcode in all versions up to, and including, 4.3.8.Check if you run itEPSS 0.22%Apr 16, 2026
- High7.1LINE client for iOS versions prior to 26.3.0 contains a vulnerability in the in-app browser where opening a crafted web page can repeatedly trigger OS-level dialogs du…Check if you run itEPSS 0.30%Apr 16, 2026
- Medium6.1cusrev customer_reviews_for_woocommerce Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.33%Apr 16, 2026
- High8.8The Livemesh Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.0.Check if you run itEPSS 0.82%Apr 16, 2026
- Medium6.4The Livemesh Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting via plugin settings in all ve…Check if you run itEPSS 0.32%Apr 16, 2026
- Medium6.4The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'put…Check if you run itEPSS 0.27%Apr 16, 2026
- High7.5The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and includi…Check if you run itEPSS 0.23%Apr 16, 2026
- Medium6.5The Accessibility Suite by Ability, Inc plugin for WordPress is vulnerable to SQL Injection via the 'scan_id' parameter in all versions up to, and including, 4.20.Check if you run itEPSS 0.35%Apr 16, 2026
- High8.8The AcyMailing plugin for WordPress is vulnerable to privilege escalation in all versions From 9.11.0 up to, and including, 10.8.1 due to a missing capability check on…Check if you run itEPSS 0.43%Apr 16, 2026
- High7.5The Riaxe Product Customizer plugin for WordPress is vulnerable to SQL Injection via the 'options' parameter keys within 'product_data' of the /wp-json/InkXEProductDes…Check if you run itEPSS 0.49%Apr 16, 2026
- Critical9.8The Riaxe Product Customizer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.2.Check if you run itEPSS 0.79%Apr 16, 2026
Sort