CVE mentions, exploit signals, and PoC evidence in one fast public view.
Loading current evidence
Historical archive search
Search decades of CVEs by regex, severity, date, CWE, vendor/product tags, KEV, PoC, and other evidence.
Results
321 results · Sorted by Highest Buzz score first
IP Login trusted forwarded client-IP headers without requiring a configured trusted proxy. Attackers could spoof the IP used for automatic login and potentially impersonate mapped…
Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy.
Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could r…
Administrator URL purges did not consistently require a valid token and cache-management permission.
Custom purge and log paths could escape the site webroot directory.
Custom query URLs could access internal or reserved network services.
CDN credentials were exposed in administrator request URLs.
GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass.
Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates.
MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability.
Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions.
CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata.
Modals gallery paths could enumerate unintended directories.
ReReplacer XML include paths could read files outside the site directory.
Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing co…
Shortcut configuration accepted arbitrary inline JavaScript.
The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens.
The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions.
A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affects timel…
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript…
The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.php?page=po…
Every filter state lives in the URL so you can bookmark, share, and crawl exact historical slices instead of a client-only search session.
Buzz order uses the latest all-time evidence snapshot, refreshed every two hours. Evidence-bearing CVEs rank first; records without a snapshot continue newest-first.