Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.8TrueConf Client Download of Code Without Integrity Check VulnerabilityPatch nowKEVEPSS 0.33%Mar 30, 2026
- High8.6XenForo before 2.3.9 and before 2.2.18 allows remote code execution (RCE) by authenticated, but malicious, admin users.Patch nowKEVEPSS 0.90%Mar 30, 2026
- UnknownImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 1.54%Mar 30, 2026
- High8.8Langflow Langflow Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 4.76%Mar 27, 2026
- Medium5.3The LeadConnector WordPress plugin before 3.0.22 does not have authorization in a REST route, allowing unauthenticated users to call it and overwrite existing dataPatch nowKEVEPSS 0.68%Mar 26, 2026
- Medium6.5Responsive Plus Ajax Action Arbitrary Shortcode Execution VulnerabilityPatch nowKEVEPSS 0.32%Mar 26, 2026
- High8.8The Amelia Booking plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 9.1.2.Patch nowKEVEPSS 0.55%Mar 26, 2026
- Medium6.5pickplugins product_slider_for_woocommerce Missing AuthorizationPatch nowKEVEPSS 0.34%Mar 25, 2026
- High8.7A SQL Injection vulnerability has been found in Support Board v3.7.7.Patch nowKEVEPSS 0.24%Mar 25, 2026
- High8.7Langflow is a tool for building and deploying AI-powered agents and workflows.Patch nowKEVEPSS 2.03%Mar 24, 2026
- Critical9.9Langflow is a tool for building and deploying AI-powered agents and workflows.Patch nowKEVEPSS 1.05%Mar 24, 2026
- Critical9.8Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')Patch nowKEVEPSS 0.99%Mar 24, 2026
- UnknownQualitor qualitor Improper Neutralization of Special Elements used in a Command ('Command Injection')Patch nowKEVEPSS 14.31%Mar 24, 2026
- Critical10.0WWBN AVideo is an open source video platform.Patch nowKEVEPSS 11.24%Mar 23, 2026
- Critical9.3Citrix NetScaler Out-of-Bounds Read VulnerabilityPatch nowKEVEPSS 4.04%Mar 23, 2026
- Medium5.3The trx_addons WordPress plugin before 2.38.5 does not correctly validate file types in one of its AJAX action, allowing unauthenticated users to upload arbitrary file.Patch nowKEVEPSS 0.29%Mar 23, 2026
- Critical9.4Aquasecurity Trivy Embedded Malicious Code VulnerabilityPatch nowKEVEPSS 1.68%Mar 23, 2026
- Medium5.4passwordprotectwp password_protect_wordpress Missing AuthorizationPatch nowKEVEPSS 0.23%Mar 23, 2026
- UnknownTP-Link tl-wr849n_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 42.67%Mar 23, 2026
- Unknownzeit next.js Relative Path TraversalPatch nowKEVEPSS 44.78%Mar 23, 2026
- UnknownMicrosoft Windows Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 95.99%Mar 23, 2026
- High8.1The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.29.7.Patch nowKEVEPSS 0.54%Mar 21, 2026
- High7.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 2.41%Mar 20, 2026
- Critical9.8Mesop is a Python-based UI framework that allows users to build web applications.Patch nowKEVEPSS 4.11%Mar 20, 2026
- Critical9.8The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function.Patch nowKEVEPSS 4.43%Mar 20, 2026