Live intelligence from Wordfence Intelligence, WPScan, NVD, and CISA KEV — updated daily. Check if your plugins and themes have known CVEs.
46,624 vulnerabilities found (page 124 of 1865)
| CVE ID | Plugin / Theme | Severity | CVSS | Description | Fixed In | Source |
|---|---|---|---|---|---|---|
| CVE-2024-38856 KEV | ofbiz | CRITICAL | 9.0 | Apache OFBiz contains an incorrect authorization vulnerability that could allow remote code execution via a Groovy paylo… | — | cisa_kev |
| CVE-2024-38475 KEV | http-server | CRITICAL | 9.0 | Apache HTTP Server contains an improper escaping of output vulnerability in mod_rewrite that allows an attacker to map U… | — | cisa_kev |
| CVE-2024-32113 KEV | ofbiz | CRITICAL | 9.0 | Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution. | — | cisa_kev |
| CVE-2024-27348 KEV | hugegraph-server | CRITICAL | 9.0 | Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute … | — | cisa_kev |
| CVE-2023-46604 KEV | activemq | CRITICAL | 9.0 | Apache ActiveMQ contains a deserialization of untrusted data vulnerability that may allow a remote attacker with network… | — | cisa_kev |
| CVE-2023-33246 KEV | rocketmq | CRITICAL | 9.0 | Several components of Apache RocketMQ, including NameServer, Broker, and Controller, are exposed to the extranet and lac… | — | cisa_kev |
| CVE-2023-27524 KEV | superset | CRITICAL | 9.0 | Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authe… | — | cisa_kev |
| CVE-2023-23752 KEV | joomla | CRITICAL | 9.0 | Joomla! contains an improper access control vulnerability that allows unauthorized access to webservice endpoints. | — | cisa_kev |
| CVE-2022-33891 KEV | spark | CRITICAL | 9.0 | Apache Spark contains a command injection vulnerability via Spark User Interface (UI) when Access Control Lists (ACLs) a… | — | cisa_kev |
| CVE-2022-24706 KEV | couchdb | CRITICAL | 9.0 | Apache CouchDB contains an insecure default initialization of resource vulnerability which can allow an attacker to esca… | — | cisa_kev |
| CVE-2022-24112 KEV | apisix | CRITICAL | 9.0 | Apache APISIX contains an authentication bypass vulnerability that allows for remote code execution. | — | cisa_kev |
| CVE-2021-45046 KEV | log4j2 | CRITICAL | 9.0 | Apache Log4j2 contains a deserialization of untrusted data vulnerability due to the incomplete fix of CVE-2021-44228, wh… | — | cisa_kev |
| CVE-2021-44228 KEV | log4j2 | CRITICAL | 9.0 | Apache Log4j2 contains a vulnerability where JNDI features do not protect against attacker-controlled JNDI-related endpo… | — | cisa_kev |
| CVE-2021-42013 KEV | http-server | CRITICAL | 9.0 | Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if f… | — | cisa_kev |
| CVE-2021-41773 KEV | http-server | CRITICAL | 9.0 | Apache HTTP Server contains a path traversal vulnerability that allows an attacker to perform remote code execution if f… | — | cisa_kev |
| CVE-2021-40438 KEV | apache | CRITICAL | 9.0 | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. Th… | — | cisa_kev |
| CVE-2020-25213 KEV | file-manager-plugin | CRITICAL | 9.0 | WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execut… | — | cisa_kev |
| CVE-2020-1956 KEV | kylin | CRITICAL | 9.0 | Apache Kylin contains an OS command injection vulnerability which could permit an attacker to perform remote code execut… | — | cisa_kev |
| CVE-2020-1938 KEV | tomcat | CRITICAL | 9.0 | Apache Tomcat treats Apache JServ Protocol (AJP) connections as having higher trust than, for example, a similar HTTP co… | — | cisa_kev |
| CVE-2020-17530 KEV | struts | CRITICAL | 9.0 | Forced Object-Graph Navigation Language (OGNL) evaluation in Apache Struts, when evaluated on raw user input in tag attr… | — | cisa_kev |
| CVE-2020-17519 KEV | flink | CRITICAL | 9.0 | Apache Flink contains an improper access control vulnerability that allows an attacker to read any file on the local fil… | — | cisa_kev |
| CVE-2020-13927 KEV | airflows-experimental-api | CRITICAL | 9.0 | The previous default setting for Airflow's Experimental API was to allow all API requests without authentication. | — | cisa_kev |
| CVE-2020-13671 KEV | drupal-core | CRITICAL | 9.0 | Improper sanitization in the extension file names is present in Drupal core. | — | cisa_kev |
| CVE-2020-11978 KEV | airflow | CRITICAL | 9.0 | A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow. | — | cisa_kev |
| CVE-2020-11738 KEV | snap-creek-duplicator-plugin | CRITICAL | 9.0 | WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy o… | — | cisa_kev |
Vulnerability information shown by EzyAudit comes from the sources below. Each Wordfence Intelligence record links back to its record page.
Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Terms.
CVE data. Copyright 1999-2026 The MITRE Corporation. CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Terms of Use.
EzyAudit AI automatically detects your installed plugins and checks them against this database — in seconds.
Scan My Website →