Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute.Check if you run itEPSS 0.33%May 7, 2026
- High7.6FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.Check if you run itEPSS 0.30%May 7, 2026
- High7.0BentoPDF is a client-side PDF toolkit that is self hostable.Check if you run itEPSS 0.46%May 7, 2026
- Medium5.4A Cross-Site Scripting (XSS) vulnerability was found in PHPGurukal Hospital Management System v4.0 in the /hospital/hms/edit-profile.php page.Check if you run itEPSS 0.23%May 7, 2026
- Medium5.4Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5.Check if you run itEPSS 0.30%May 7, 2026
- Medium6.1Sidekiq-cron thru 2.3.1, an open-source scheduling add-on for Sidekiq, is vulnerable to a cross-site scripting (xss) vulnerability via crafted URL being rended from cron.erb.Check if you run itEPSS 0.19%May 7, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricks Builder allows Reflected XSS.Check if you run itEPSS 0.25%May 7, 2026
- High8.8Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc.Check if you run itEPSS 0.45%May 7, 2026
- Medium6.8Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in misp allows Stored XSS.Check if you run itEPSS 0.24%May 7, 2026
- High8.8Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gosoft Software Industry and Trade Ltd.Check if you run itEPSS 0.45%May 7, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons allows Stored XSS.Check if you run itEPSS 0.22%May 7, 2026
- Medium5.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Themes WEN Logo Slider allows DOM-Based XSS.Check if you run itEPSS 0.14%May 7, 2026
- Medium6.1Admidio is an open-source user management solution.Check if you run itEPSS 0.29%May 7, 2026
- Critical9.1CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support.Check if you run itEPSS 0.56%May 7, 2026
- Medium6.1Postorius through 1.3.13 does not escape HTML in the message subject when rendering it in the Held messages pop-up, as exploited in the wild in May 2026.Patch nowKEVEPSS 0.33%May 7, 2026
- Medium5.4PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files.Check if you run itEPSS 0.25%May 6, 2026
- High8.4In Jupyter Notebook versions 7.0.0 through 7.5.5, JupyterLab versions 4.5.6 and earlier, and the corresponding @jupyter-notebook/help-extension and @jupyterlab/help-ex…Check if you run itEPSS 0.66%May 6, 2026
- Medium5.4Inappropriate implementation in MHTML in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to inject arbitrary sc…Check if you run itEPSS 0.22%May 6, 2026
- Medium5.4Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to inje…Check if you run itEPSS 0.17%May 6, 2026
- Medium5.4Inappropriate implementation in SanitizerAPI in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.Check if you run itEPSS 0.19%May 6, 2026
- Medium5.4Cross Site Scripting vulnerability in Juzaweb CMS v.5.0.0 allows a remote attacker via execute arbitrary code via a crafted script to the Add Banner Ads functionCheck if you run itEPSS 0.34%May 6, 2026
- Medium6.1HCL DFXAnalytics is affected by an Insecure Security Header Configuration vulnerability where the application utilizes the outdated X-XSS-Protection header, which coul…Check if you run itEPSS 0.12%May 6, 2026
- Medium6.1HCL DFXAnalytics is affected by an Insecure Security Header configuration vulnerability where the Content-Security-Policy does not define strict directives for object-…Check if you run itEPSS 0.15%May 6, 2026
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.Check if you run itEPSS 0.57%May 6, 2026
- Medium6.4The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.5.0.Check if you run itEPSS 0.45%May 6, 2026