Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.2EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' ParameterCheck if you run itEPSS 0.24%Oct 16, 2026
- Medium6.4Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' ParameterCheck if you run itEPSS 0.19%Oct 16, 2026
- Medium6.4Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode AttributeCheck if you run itEPSS 0.19%Oct 16, 2026
- Medium4.9Welcart e-Commerce <= 2.12.4 - Authenticated (Editor+) SQL Injection via 'wp_usces_order_old' CookieCheck if you run itEPSS 0.30%Oct 16, 2026
- Medium6.5LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX ActionCheck if you run itEPSS 0.25%Oct 16, 2026
- Low3.7Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' ParameterCheck if you run itEPSS 0.29%Oct 16, 2026
- High7.2LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' ParametersCheck if you run itEPSS 0.29%Oct 16, 2026
- High7.5Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' ParameterCheck if you run itEPSS 0.40%Oct 16, 2026
- Critical9.1Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts CounterCheck if you run itEPSS 0.40%Oct 16, 2026
- Medium6.1Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' ParameterCheck if you run itEPSS 0.23%Oct 16, 2026
- High7.2Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template ImportCheck if you run itEPSS 0.47%Oct 16, 2026
- Critical9.6An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header iCheck if you run itEPSS 0.29%Oct 16, 2026
- Critical9.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin.Check if you run itEPSS 0.69%Oct 16, 2026
- Critical9.8Deserialization of Untrusted Data vulnerability in Apache Kylin.Check if you run itEPSS 0.58%Oct 16, 2026
- Critical9.1Missing Authorization vulnerability in Apache Kylin.Check if you run itEPSS 0.41%Oct 16, 2026
- High7.5A flaw was found in spice-server.Check if you run itEPSS 0.25%Oct 16, 2026
- Low3.3libblockdev: libblockdev: argument injection in NTFS/VFAT label-setting helpers via udisks2 SetLabel() D-Bus methodCheck if you run itEPSS 0.13%Oct 16, 2026
- Medium6.0Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the l…Check if you run itEPSS 0.28%Oct 16, 2026
- High7.5A flaw was found in spice-server.Check if you run itEPSS 0.40%Oct 16, 2026
- CriticalApache Kylin: JDBC URL Whitelist Verification BypassCheck if you run itEPSS 0.53%Oct 16, 2026
- Medium6.6A flaw was found in Nautilus.Check if you run itEPSS 0.13%Oct 16, 2026
- High7.3vim: Vim: Arbitrary code execution via 'helpfile' option processingCheck if you run itEPSS 0.22%Oct 16, 2026
- Medium6.0A flaw was found in luksmeta.Check if you run itEPSS 0.11%Oct 16, 2026
- High7.1Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow.Check if you run itEPSS 0.21%Oct 16, 2026
- Medium5.3Active debug code vulnerability in SFM Software Technologies Inc.Check if you run itEPSS 0.20%Oct 16, 2026