Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.4SpiceDB is an open source database system for creating and managing security-critical application permissions.Check if you run itEPSS 0.17%Apr 15, 2026
- Medium5.5Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.Check if you run itEPSS 0.10%Apr 15, 2026
- Medium6.9Serendipity is a PHP-powered weblog engine.Check if you run itEPSS 0.23%Apr 15, 2026
- High7.2The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ parameter in all…Check if you run itEPSS 0.34%Apr 15, 2026
- Critical9.8The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up to, and…Check if you run itEPSS 1.00%Apr 15, 2026
- Medium4.3The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1.Check if you run itEPSS 0.29%Apr 15, 2026
- Medium5.4The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1.Check if you run itEPSS 0.32%Apr 15, 2026
- High8.4radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embeddinCheck if you run itEPSS 1.21%Apr 15, 2026
- High8.1Withdrawn Advisory: Apache Airflow: RCE by race condition in example_xcom dagCheck if you run itEPSS 0.59%Apr 15, 2026
- High7.5Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header.Check if you run itEPSS 0.46%Apr 15, 2026
- High7.5An issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows attackers to execute a directory traversal and read arbitrary files from the system viaCheck if you run itEPSS 0.75%Apr 15, 2026
- High8.6Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador_ver.php endpoint.Check if you run itEPSS 0.23%Apr 15, 2026
- High7.5Incorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access sensitive information, including active session credentialsCheck if you run itEPSS 0.26%Apr 15, 2026
- Critical9.8Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality.Check if you run itEPSS 1.01%Apr 15, 2026
- High8.6Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature.Check if you run itEPSS 0.42%Apr 15, 2026
- High8.6LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execution handling.Check if you run itEPSS 0.49%Apr 15, 2026
- High7.3Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling.Check if you run itEPSS 0.36%Apr 15, 2026
- High8.0A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system.Check if you run itEPSS 0.29%Apr 15, 2026
- High8.3Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submCheck if you run itEPSS 0.55%Apr 15, 2026
- High7.5CentSDR commit e40795 was discovered to contain a stack overflow in the "Thread1" function.Check if you run itEPSS 0.32%Apr 15, 2026
- High8.4Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code execution via injection oCheck if you run itEPSS 0.58%Apr 15, 2026
- Medium5.1immich is a high performance self-hosted photo and video management solution.Check if you run itEPSS 0.21%Apr 14, 2026
- High7.1Zarf is an Airgap Native Packager Manager for Kubernetes.Check if you run itEPSS 0.33%Apr 14, 2026
- High7.2Serendipity is a PHP-powered weblog engine.Check if you run itEPSS 0.26%Apr 14, 2026
- Medium4.4The List View Google Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event description in all versions up to, and including, 7.4.3 due to insuffiCheck if you run itEPSS 0.23%Apr 14, 2026
Sort