Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.3The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private…EPSS 0.2%Oct 14, 2026
- Medium4.3The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authen…EPSS 0.2%Oct 14, 2026
- Medium6.8The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline scrip…EPSS 0.2%Oct 14, 2026
- Medium5.3The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allo…EPSS 0.1%Oct 14, 2026
- Medium5.3The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, all…EPSS 0.2%Oct 14, 2026
- High8.8The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an…EPSS 0.2%Oct 14, 2026
- Medium5.9The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unatta…EPSS 0.2%Oct 14, 2026
- UnknownThe Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inserted into the page in the b…EPSS 0.2%Oct 14, 2026
- Medium5.3The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing un…EPSS 0.2%Oct 14, 2026
- Medium5.3The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token that the WP Data…EPSS 0.2%Oct 14, 2026
- Medium5.3The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission befor…EPSS 0.2%Oct 14, 2026
- Medium5.3The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result…EPSS 0.2%Oct 14, 2026
- Medium5.3The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to ret…EPSS 0.2%Oct 14, 2026
- Medium6.8The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe H…EPSS 0.2%Oct 14, 2026
- Medium5.3The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated u…EPSS 0.2%Oct 14, 2026
- Medium6.8The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline scr…EPSS 0.2%Oct 14, 2026
- High8.6The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and ve…EPSS 0.2%Oct 14, 2026
- Medium6.5A defect in the Qt for MCUs core string handling causes heap memory corruption.EPSS 0.3%Oct 14, 2026
- Medium4.7A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of serv…EPSS 0.1%Oct 14, 2026
- Medium5.3An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, wh…EPSS 0.3%Oct 14, 2026
- High8.6A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthori…EPSS 0.3%Oct 14, 2026
- Low3.7A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or trunc…EPSS 0.3%Oct 14, 2026
- Low3.7A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain informat…EPSS 0.3%Oct 14, 2026
- High7.0Multiple smartphones provided by Rakuten Mobile, Inc.EPSS 0.2%Oct 14, 2026
- Medium6.7The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component.EPSS 1.7%Oct 14, 2026