Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Low3.1ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)Oct 16, 2026
- High7.5sync 2026-10-16T15:41:51ZOct 16, 2026
- High7.8Important: ghostscript security updateOct 16, 2026
- High7.8Important: ghostscript security updateOct 16, 2026
- UnknownThe Coinsnap Bitcoin Crowdfunding WordPress plugin through 1.2.0 does not restrict access to the secret used to authenticate its payment gateway webhook, disclosing it…Oct 16, 2026
- Medium6.4The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all versions up to,…EPSS 0.2%Oct 16, 2026
- UnknownThe Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subsc…EPSS 0.1%Oct 16, 2026
- High7.2The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to…Oct 16, 2026
- Medium6.5The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter.Oct 16, 2026
- High7.5The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions…EPSS 0.5%Oct 16, 2026
- Medium6.4The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter in all v…EPSS 0.2%Oct 16, 2026
- Medium6.4The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insuffi…EPSS 0.2%Oct 16, 2026
- High7.5The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.1.4.1 This is d…EPSS 0.4%Oct 16, 2026
- High7.5The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This…EPSS 0.3%Oct 16, 2026
- Medium5.9Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application.EPSS 0.1%Oct 16, 2026
- Medium5.1Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holi…EPSS 0.2%Oct 15, 2026
- High8.8Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.EPSS 0.2%Oct 15, 2026
- Medium6.4Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network SettingEPSS 0.2%Oct 15, 2026
- Critical9.1Tianji is an open source analytics, uptime monitoring, and server status platform.Oct 15, 2026
- Medium4.8Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward p…EPSS 0.4%Oct 15, 2026
- High8.6Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as…EPSS 7.1%Oct 15, 2026
- Medium6.8Ansilove libansilove through 1.4.2 contains an out-of-bounds read vulnerability in ansilove_xbin() in src/loaders/xbin.c that lacks bounds checks for compressed run-length records.EPSS 0.1%Oct 15, 2026
- Medium6.9libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer…EPSS 0.1%Oct 15, 2026
- Medium6.9GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSe…EPSS 0.1%Oct 15, 2026
- UnknownCVE-2026-111132 affecting package libgxps 0.3.2-1Oct 15, 2026
862 records · page 1 of 35
PreviousNext