Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.3A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to acces…EPSS 0.3%Oct 14, 2026
- High8.1A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to exe…EPSS 1.2%Oct 14, 2026
- Medium5.3A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device.EPSS 0.3%Oct 14, 2026
- Medium4.0The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be root ownership.EPSS 0.1%Oct 14, 2026
- Medium4.3Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.EPSS 0.1%Oct 14, 2026
- Medium6.4The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versio…EPSS 0.3%Oct 14, 2026
- High7.2The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plu…EPSS 0.3%Oct 14, 2026
- High7.2The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and includin…EPSS 0.3%Oct 14, 2026
- High7.5The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due…EPSS 0.5%Oct 14, 2026
- High7.5The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all…EPSS 0.4%Oct 14, 2026
- High7.2The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and includ…EPSS 0.4%Oct 14, 2026
- Critical9.8The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function.EPSS 0.8%Oct 14, 2026
- High7.5The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and includ…EPSS 0.4%Oct 14, 2026
- Medium6.4The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute in all versions up to,…EPSS 0.2%Oct 14, 2026
- High7.5Nix before 2.35.3 and Lix before 2.95.4 have an integer overflow and resultant out-of-bounds write when evaluating untrusted expressions because list allocation is mishandled.EPSS 0.2%Oct 14, 2026
- Medium4.7The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to…EPSS 0.2%Oct 14, 2026
- High7.2The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including,…EPSS 0.3%Oct 14, 2026
- High8.6ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.EPSS 0.5%Oct 13, 2026
- Medium5.5Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service.EPSS 0.1%Oct 13, 2026
- High8.2IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.EPSS 0.2%Oct 13, 2026
- High7.5IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 Liberty could allow a remote attacker to cause…EPSS 0.4%Oct 13, 2026
- High7.8Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.EPSS 0.2%Oct 13, 2026
- High7.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.EPSS 0.2%Oct 13, 2026
- High7.8Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.EPSS 0.2%Oct 13, 2026
- Medium5.5Substance3D - Designer is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service.EPSS 0.1%Oct 13, 2026