Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8Fortinet FortiSandbox OS Command Injection VulnerabilityPatch nowKEVEPSS 47.36%Apr 14, 2026
- Medium4.3Microsoft Windows Protection Mechanism Failure VulnerabilityPatch nowKEVEPSS 4.90%Apr 14, 2026
- High8.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 0.45%Apr 13, 2026
- Unknownmjdm majordomo Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 7.84%Apr 13, 2026
- Medium6.5Microsoft SharePoint Server Improper Input Validation VulnerabilityPatch nowKEVEPSS 43.38%Apr 12, 2026
- Unknownusememos memos Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 2.93%Apr 12, 2026
- UnknownNETGEAR dgn2200_firmware Improper AuthenticationPatch nowKEVEPSS 2.11%Apr 12, 2026
- Medium6.5Arcane is an interface for managing Docker containers, images, networks, and volumes.Patch nowKEVEPSS 0.72%Apr 10, 2026
- High8.8LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.Patch nowKEVEPSS 3.40%Apr 10, 2026
- UnknownTP-Link archer_ax3000_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 1.06%Apr 10, 2026
- High8.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 0.27%Apr 9, 2026
- High7.5Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityPatch nowKEVEPSS 6.56%Apr 9, 2026
- Critical9.8The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1.Patch nowKEVEPSS 8.09%Apr 9, 2026
- Critical9.3Marimo Remote Code Execution VulnerabilityPatch nowKEVEPSS 37.87%Apr 9, 2026
- UnknownLangflow Langflow Missing Authentication for Critical FunctionPatch nowKEVEPSS 33.29%Apr 9, 2026
- UnknownSPIP saisies Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 5.59%Apr 9, 2026
- UnknownImproper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Patch nowKEVEPSS 51.12%Apr 9, 2026
- Critical9.8The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all versions up to and including 1.1.15.Patch nowKEVEPSS 1.31%Apr 8, 2026
- Critical9.8WPEverest everest_forms Deserialization of Untrusted DataPatch nowKEVEPSS 2.98%Apr 8, 2026
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.38%Apr 8, 2026
- Unknownartica pandora_fms Missing Authentication for Critical FunctionPatch nowKEVEPSS 4.81%Apr 8, 2026
- Unknownpandorafms pandora_fms Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 90.99%Apr 8, 2026
- Medium6.3Vite is a frontend tooling framework for JavaScript.Patch nowKEVEPSS 0.98%Apr 7, 2026
- High8.2Vite is a frontend tooling framework for JavaScript.Patch nowKEVEPSS 1.54%Apr 7, 2026
- Critical9.8Cockpit's remote login feature passes user-supplied hostnames and usernames from the web interface to the SSH client without validation or sanitization.Patch nowKEVEPSS 9.22%Apr 7, 2026