147492+ vulnerabilities with CVSS scores, EPSS exploit predictions, and CISA KEV status. Updated daily.
Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.
Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.
Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.
Unauthenticated Broken Access Control in DK <= 3.2.1 versions.
Unauthenticated Broken Access Control in Grand News <= 3.4 versions.
Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a …
Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue …
Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue …
Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions.
Subscriber SQL Injection in Events Manager <= 7.4.6 versions.
Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.
Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager <= 0.2.25 versions.
Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.
Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.
Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot <= 3.8.2 versions.
Subscriber Settings Change in Pubjet | پابجت <= 5.4.8 versions.
Subscriber Broken Access Control in Wordable <= 8.2.10 versions.
Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.
Subscriber Broken Access Control in WPSection <= 1.5.1 versions.
Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.
Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.
Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.
Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.
Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only …
slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers …
Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using …
Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.
Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions.
Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects …
Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.
Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a …
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects …
open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root …
phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission …
Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can …
Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers …
OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know …
Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to …
Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. …
9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the …
mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt …
InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP …
Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.
Free website and port scanning — find vulnerabilities before attackers do.