Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7.Check if you run itEPSS 0.89%Oct 16, 2026
- High7.5The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and…Check if you run itEPSS 0.38%Oct 16, 2026
- Medium6.5The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and incl…Check if you run itEPSS 0.28%Oct 16, 2026
- Medium4.4ZDI-26-780: X.Org Server GestureBuildSprite Use-After-Free Information Disclosure VulnerabilityOpen the advisoryOct 16, 2026
- High7.8ZDI-26-785: FreeBSD Kernel Shared Memory Time-Of-Check Time-Of-Use Local Privilege Escalation VulnerabilityCheck if you run itEPSS 0.12%Oct 16, 2026
- High8.8ZDI-26-784: FreeBSD Kernel kqueue Use-After-Free Local Privilege Escalation VulnerabilityCheck if you run itEPSS 0.10%Oct 16, 2026
- Medium6.4The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortcode Attri…Check if you run itEPSS 0.16%Oct 16, 2026
- Medium4.3The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Object Ref…Check if you run itEPSS 0.21%Oct 16, 2026
- High7.8Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents.Check if you run itEPSS 0.14%Oct 16, 2026
- Medium5.9Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application.Check if you run itEPSS 0.14%Oct 16, 2026
- Medium5.9Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default).Check if you run itEPSS 0.21%Oct 16, 2026
- Low3.7Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems.Check if you run itEPSS 0.21%Oct 16, 2026
- High8.1Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved.Check if you run itEPSS 0.28%Oct 16, 2026
- High8.6Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it is by default in development.Check if you run itEPSS 0.26%Oct 16, 2026
- Medium6.5Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-…Check if you run itEPSS 0.16%Oct 16, 2026
- Medium5.3Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags.Check if you run itEPSS 0.23%Oct 16, 2026
- High7.2The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…Check if you run itEPSS 0.31%Oct 16, 2026
- Medium5.9The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter.Check if you run itEPSS 0.77%Oct 16, 2026
- High8.1The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the parameter in versions up to, and including, 3.3.0.Check if you run itEPSS 0.52%Oct 16, 2026
- Medium4.8A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52.Check if you run itEPSS 0.12%Oct 16, 2026
- High8.3Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing ValidationCheck if you run itEPSS 0.22%Oct 16, 2026
- High7.1Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List EndpointCheck if you run itEPSS 0.26%Oct 16, 2026
- Medium5.3Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfigCheck if you run itEPSS 0.21%Oct 16, 2026
- Medium6.3Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer ToolsCheck if you run itEPSS 0.19%Oct 16, 2026
- High7.1Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocketCheck if you run itEPSS 0.29%Oct 16, 2026