Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-beari…Check if you run itEPSS 0.24%Oct 14, 2026
- Medium6.5The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning rout…Check if you run itEPSS 0.21%Oct 14, 2026
- Medium5.3The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allo…Check if you run itEPSS 0.16%Oct 14, 2026
- High8.8The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an…Check if you run itEPSS 0.46%Oct 14, 2026
- Medium5.9The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unatta…Check if you run itEPSS 0.25%Oct 14, 2026
- Medium5.3The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing un…Check if you run itEPSS 0.23%Oct 14, 2026
- Medium5.3The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to ret…Check if you run itEPSS 0.27%Oct 14, 2026
- High7.2The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plu…Check if you run itEPSS 0.31%Oct 14, 2026
- Medium5.3The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter.Check if you run itEPSS 0.28%Oct 14, 2026
- High7.5The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and includ…Check if you run itEPSS 0.42%Oct 14, 2026
- High7.2The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and includin…Check if you run itEPSS 0.31%Oct 14, 2026
- High7.2The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including,…Check if you run itEPSS 0.31%Oct 14, 2026
- MediumCVE-2026-98430: RDMA/efa: Keep admin queues alive while IRQ is registeredCheck if you run itEPSS 0.21%Oct 14, 2026
- MediumCVE-2026-98426: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error pathCheck if you run itEPSS 0.22%Oct 14, 2026
- Highwifi: mac80211: don't warn when an IBSS has no channel to scanCheck if you run itEPSS 0.21%Oct 14, 2026
- HighCVE-2026-98421: wifi: mac80211: require a peer station for TDLS setup confirmCheck if you run itEPSS 0.21%Oct 14, 2026
- MediumIn the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn() If devm_kcalloc(…Check if you run itEPSS 0.22%Oct 14, 2026
- Highselinux: always fill AVC decision in avc_has_perm_noaudit()Check if you run itEPSS 0.22%Oct 14, 2026
- Highscsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slotCheck if you run itEPSS 0.21%Oct 14, 2026
- Low3.1Apprise forwards configured auth headers across cross-origin HTTP redirectsCheck if you run itEPSS 0.32%Oct 14, 2026
- High8.6ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.Check if you run itEPSS 0.48%Oct 13, 2026
- Critical9.1Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by co…Check if you run itEPSS 0.33%Oct 13, 2026
- High7.7Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UKismetSystemLibrary::LaunchURL).Check if you run itEPSS 0.39%Oct 13, 2026
- Critical9.8The Snazzy Social Media Feed plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.5 via the (file scope) function.Check if you run itEPSS 0.98%Oct 13, 2026
- Medium6.8Distribution: Client does not verify returned content against requested digestCheck if you run itEPSS 0.21%Oct 13, 2026