Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not proper…Check if you run itEPSS 0.33%Oct 16, 2026
- Medium6.4The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insuffi…Check if you run itEPSS 0.22%Oct 16, 2026
- Medium6.5The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to,…Check if you run itEPSS 0.27%Oct 16, 2026
- High7.5The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and…Check if you run itEPSS 0.38%Oct 16, 2026
- Medium5.9Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application.Check if you run itEPSS 0.14%Oct 16, 2026
- Medium5.9Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default).Check if you run itEPSS 0.21%Oct 16, 2026
- High8.1Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being saved.Check if you run itEPSS 0.28%Oct 16, 2026
- High8.1Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=).Check if you run itEPSS 0.28%Oct 16, 2026
- Critical9.8Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to i…Check if you run itEPSS 0.26%Oct 16, 2026
- Medium6.5Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-…Check if you run itEPSS 0.16%Oct 16, 2026
- Medium5.9The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter.Check if you run itEPSS 0.77%Oct 16, 2026
- Medium4.8The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.2.Check if you run itEPSS 0.26%Oct 16, 2026
- High8.3Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing ValidationCheck if you run itEPSS 0.22%Oct 16, 2026
- High7.1Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List EndpointCheck if you run itEPSS 0.26%Oct 16, 2026
- Medium6.3Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer ToolsCheck if you run itEPSS 0.19%Oct 16, 2026
- Medium5.0FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZECheck if you run itEPSS 0.14%Oct 16, 2026
- Medium6.0FreeRDP from 3.30.0 before 3.32.0 Resource Exhaustion via rdpecam StartStreamsRequestCheck if you run itEPSS 0.24%Oct 16, 2026
- Medium6.9A vulnerability was determined in bitcoinj up to 0.17.Check if you run itEPSS 0.29%Oct 16, 2026
- High7.2The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Si…Check if you run itEPSS 0.24%Oct 16, 2026
- Medium4.3Arcane: Environment access token bypasses the admin-required authorization gate onCheck if you run itEPSS 0.20%Oct 16, 2026
- High8.8Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)Check if you run itEPSS 0.29%Oct 16, 2026
- Low3.1ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)Open the advisoryOct 16, 2026
- Low3.7CoreDNS headless AXFR can emit an empty transfer batch that panics the pluginCheck if you run itEPSS 0.46%Oct 16, 2026
- Critical9.1MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts.Check if you run itEPSS 0.34%Oct 15, 2026
- Low2.3crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers.Check if you run itEPSS 0.26%Oct 15, 2026