Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.0Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team…Check if you run itEPSS 0.16%Oct 16, 2026
- High7.1Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the integrity of the SAML RelayState POST parameter which a…Check if you run itEPSS 0.19%Oct 16, 2026
- Medium6.5Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of remote image responses buffered in memory during…Check if you run itEPSS 0.28%Oct 16, 2026
- High8.8The YaySMTP – WP Mail SMTP with Email Logs, Tracking & Reports plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.7.7…Check if you run itEPSS 0.57%Oct 16, 2026
- Medium4.3Mattermost versions 11.10.x <= 11.10.0, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to cap the number and size of mention keys stored in a user's notifi…Check if you run itEPSS 0.21%Oct 16, 2026
- Medium4.3Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize the active channel field returned by the user status API…Check if you run itEPSS 0.18%Oct 16, 2026
- Medium4.9Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to invalidate the stored AD/LDAP bind password when other connection…Check if you run itEPSS 0.23%Oct 16, 2026
- Medium6.5Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to require re-entry of the stored client secret when validating an o…Check if you run itEPSS 0.22%Oct 16, 2026
- Medium6.4Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to enforce DM/GM check on server side which allows an authenticated u…Check if you run itEPSS 0.15%Oct 16, 2026
- Medium6.5Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the combination of guest and admin scheme roles which all…Check if you run itEPSS 0.22%Oct 16, 2026
- Medium5.4The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for…Check if you run itEPSS 0.18%Oct 16, 2026
- Medium5.4The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removi…Check if you run itEPSS 0.29%Oct 16, 2026
- Low2.7The WP Mail Logging plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.17.0 via the 'email_address' parameter.Check if you run itEPSS 0.32%Oct 16, 2026
- Medium6.5The WSP MCP AI Agents Connector plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.9.5.Check if you run itEPSS 0.35%Oct 16, 2026
- Medium6.8The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.5.6 This is due to th…Check if you run itEPSS 0.46%Oct 16, 2026
- High7.2The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in…Check if you run itEPSS 0.30%Oct 16, 2026
- Medium5.3The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4…Check if you run itEPSS 0.35%Oct 16, 2026
- Medium4.8The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The…Check if you run itEPSS 0.31%Oct 16, 2026
- Critical9.8The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and…Check if you run itEPSS 0.51%Oct 16, 2026
- UnknownMalicious code in @flexmr/survey-conversation (npm)Open the advisoryOct 16, 2026
- UnknownMalicious code in @flexmr/survey-client (npm)Open the advisoryOct 16, 2026
- High7.2The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site S…Check if you run itEPSS 0.25%Oct 16, 2026
- Medium6.5The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter.Check if you run itEPSS 0.58%Oct 16, 2026
- High8.8The PilotPress plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 2.0.43.Check if you run itEPSS 0.37%Oct 16, 2026
- Medium6.4The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up to, and…Check if you run itEPSS 0.20%Oct 16, 2026