Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3The Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, an…Check if you run itEPSS 0.22%May 22, 2026
- Medium5.3The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1.Check if you run itEPSS 0.28%May 22, 2026
- High7.5The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2.Check if you run itEPSS 1.57%May 22, 2026
- Medium5.4A broken access control vulnerability exists in the TeamViewer DEX Platform (On‑Premises) prior version 9.2.Check if you run itEPSS 0.14%May 22, 2026
- Medium5.4The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side…Check if you run itEPSS 0.69%May 22, 2026
- Medium4.3The Slider by Soliloquy – Responsive Image Slider for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi…Check if you run itEPSS 0.24%May 22, 2026
- Medium4.3The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3.Check if you run itEPSS 0.17%May 22, 2026
- Medium6.5A bitwise shift vulnerability in Zephyr's PTP subsystem allows a remote attacker to cause undefined behavior and potential system crashes.Check if you run itEPSS 0.30%May 22, 2026
- Medium6.4The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Draft Post Title in all versions up to, and including, 2.6.3 due to insufficient i…Check if you run itEPSS 0.22%May 22, 2026
- High8.8The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.5 via…Check if you run itEPSS 0.71%May 22, 2026
- Medium6.4The KIA Subtitle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and attributes in all versions up to, and including, 4.0.1.Check if you run itEPSS 0.25%May 22, 2026
- Medium4.3The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the and functions in all versions up t…Check if you run itEPSS 0.25%May 22, 2026
- Medium6.1The CBX 5 Star Rating & Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.…Check if you run itEPSS 0.26%May 22, 2026
- Medium4.3The Alfie – Feed Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1.Check if you run itEPSS 0.16%May 22, 2026
- High7.5There is an an information disclosure vulnerability in ZTE MU5250.Check if you run itEPSS 0.22%May 22, 2026
- Medium6.1The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in all versions up to and including 0.9.14.Check if you run itEPSS 0.25%May 22, 2026
- Medium4.3The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing capability checks on the 'ultp_install_callback'…Check if you run itEPSS 0.23%May 22, 2026
- Critical9.2An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel panic.Check if you run itEPSS 0.29%May 22, 2026
- Medium6.9Mothra would respect a default value given by a website for HTML file upload forms.Check if you run itEPSS 0.28%May 22, 2026
- High7.5The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1.5.1.Check if you run itEPSS 0.27%May 22, 2026
- Medium5.3For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.Check if you run itEPSS 0.41%May 22, 2026
- High7.5An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.Check if you run itEPSS 0.47%May 22, 2026
- Critical10.0Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the…Check if you run itEPSS 0.56%May 22, 2026
- Critical9.1Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation.Check if you run itEPSS 6.91%May 22, 2026
- Medium5.3SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.Check if you run itEPSS 0.50%May 22, 2026
Sort