Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- MediumMemory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service.Oct 13, 2026
- CriticalThe Avada (Fusion) Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16.1.Oct 13, 2026
- MediumThe GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in versions up to, a…Oct 13, 2026
- MediumThe FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute in all versions up to, and incl…Oct 13, 2026
- MediumThe Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all version…Oct 13, 2026
- MediumThe SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the get_instance_css function.Oct 13, 2026
- MediumThe Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link…Oct 13, 2026
- High8.7The network messaging layer contained improper handling of highly compressed data affecting service availability.Oct 13, 2026
- High7.1QAPI contained a stack-based buffer overflow affecting service availability.Oct 13, 2026
- HighImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Reflected XSS.This issu…Oct 13, 2026
- HighImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue a…Oct 13, 2026
- CriticalCVE-2026-97229: Critical Unauthenticated Remote Code Execution in GitLabOct 13, 2026
- MediumThe Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'not_found' parameter in all versions up to, and including, 3.3.58 due t…Oct 13, 2026
- HighGitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions,…Oct 13, 2026
- HighThe Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and includi…Oct 13, 2026
- HighThe WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter…Oct 13, 2026
- MediumThe Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Field Value in all versions up to, and including, 1.…Oct 13, 2026
- HighThe Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Tag in all versions up to, and including, 4.5.1 due to insu…Oct 13, 2026
- HighThe Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all…Oct 13, 2026
- HighThe Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]'…Oct 13, 2026
- MediumThe Data Tables Generator by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action in all versi…Oct 13, 2026
- LowImproper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust the memory or disk space of t…Oct 13, 2026
- HighImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publisher to delete a directory ou…Oct 13, 2026
- MediumWhen a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the reposit…Oct 13, 2026
- HighGitea expanded a workflow's static into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied.Oct 13, 2026
50 records · page 1 of 2
PreviousNext