Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.9The AI Engine WordPress plugin before 3.7.9 does not check that the item passed to one of its media actions belongs to the requesting user before converting it to an a…Open the advisoryOct 18, 2026
- Medium6.5The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authentic…Open the advisoryOct 18, 2026
- Medium4.3The Modern Events Calendar Lite WordPress plugin before 7.37.0 does not perform capability, nonce, or ownership checks before returning event booking and attendee data…Open the advisoryOct 18, 2026
- Medium4.3The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a su…Open the advisoryOct 18, 2026
- Medium6.8The Salon Booking System WordPress plugin before 10.31.11 does not validate a user-supplied image URL before fetching it server-side and writing the response to a publ…Open the advisoryOct 18, 2026
- Medium5.5The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen,…Open the advisoryOct 18, 2026
- High7.2The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other acc…Open the advisoryOct 18, 2026
- Medium4.9The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users wi…Open the advisoryOct 18, 2026
- Medium5.4The Otter Blocks WordPress plugin before 3.2.3 does not validate that a user-supplied return URL belongs to the site before using it to build the return destination of…Open the advisoryOct 18, 2026
- Low1.9A vulnerability was found in alexpasmantier television up to 0.15.9.Open the advisoryOct 18, 2026
- Low2.0A vulnerability has been found in David-Crty Databasement up to 1.8.1.Open the advisoryOct 18, 2026
- Low2.9A flaw has been found in OpenCATS 0.10.0.Open the advisoryOct 18, 2026
- Medium5.5A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.Open the advisoryOct 18, 2026
- Medium5.5A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.Open the advisoryOct 18, 2026
- Medium5.5A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.Open the advisoryOct 18, 2026
- Medium5.5A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.Open the advisoryOct 18, 2026
- Medium5.5A vulnerability was identified in makeplane plane up to 1.4.2.Open the advisoryOct 18, 2026
- Medium6.3ip-address before 10.7.4 allows a denial of service (CPU consumption from quadratic complexity, and application stall) via many % characters in input reaching a functi…Open the advisoryOct 18, 2026
- Low2.1A vulnerability was determined in datastax pulsar-jms up to 9.0.3.Open the advisoryOct 18, 2026
- UnknownCVE-2026-108117Open the advisoryOct 17, 2026
- UnknownCVE-2026-107772Open the advisoryOct 17, 2026
- UnknownCVE-2026-107345Open the advisoryOct 17, 2026
- UnknownCVE-2026-107274Open the advisoryOct 17, 2026
- UnknownCVE-2026-105391Open the advisoryOct 17, 2026
- Low1.9A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b.Open the advisoryOct 17, 2026