Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low2.1A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1.Open the advisoryOct 18, 2026
- Low2.1A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1.Open the advisoryOct 18, 2026
- Critical9.2WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions throCheck if you run itEPSS 0.00%Oct 18, 2026
- Critical9.3Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token.Check if you run itEPSS 0.00%Oct 18, 2026
- High8.4JQ::Lite versions before 2.51 for Perl execute Perl code embedded in a query's regular expression by compiling it with string eval.Open the advisoryOct 18, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-add…Open the advisoryOct 18, 2026
- High8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite allows SQL Injection.Th…Open the advisoryOct 18, 2026
- Medium6.5Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue affects HivePress: from n/a t…Open the advisoryOct 18, 2026
- Medium6.5Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Authentication Abuse.This issu…Open the advisoryOct 18, 2026
- Medium6.5Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe…Open the advisoryOct 18, 2026
- High7.5Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on al…Open the advisoryOct 18, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointment…Open the advisoryOct 18, 2026
- High8.1Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.This issue affects Login with…Open the advisoryOct 18, 2026
- Medium6.5Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access Control Security Levels.Th…Open the advisoryOct 18, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affec…Open the advisoryOct 18, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflected XSS.This issue affects…Open the advisoryOct 18, 2026
- High8.8Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affects Strong Testimonials: fro…Open the advisoryOct 18, 2026
- Critical9.8Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational FormCheck if you run itEPSS 0.00%Oct 18, 2026
- Critical9.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics:Check if you run itEPSS 0.00%Oct 18, 2026
- High7.7The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 does not sanitise and escape a parameter befor…Open the advisoryOct 18, 2026
- Medium5.3The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, acceptin…Open the advisoryOct 18, 2026
- Low2.1A weakness has been identified in hrisikeshpal Blood_Bank_Management_System 1.0.0.Open the advisoryOct 18, 2026
- Low2.1A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571.Open the advisoryOct 18, 2026
- Medium4.9The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targe…Open the advisoryOct 18, 2026
- High7.1The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on…Open the advisoryOct 18, 2026