Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.4The web application is susceptible to cross-site-scripting attacks.Check if you run itEPSS 0.35%Jul 3, 2025
- Medium6.1A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack againstCheck if you run itEPSS 0.29%Jul 2, 2025
- Critical9.3A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling.Check if you run itEPSS 0.43%Jul 2, 2025
- Medium4.9A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailabCheck if you run itEPSS 0.38%Jul 2, 2025
- Medium6.5Unrestricted access to OS file system in SFTP service in Infinera G42 version R6.1.3 allows remote authenticated users to read/write OS files via SFTP connections.Check if you run itEPSS 0.39%Jul 2, 2025
- Medium6.5Lack or insufficent input validation in WebGUI CLI web in Infinera G42 version R6.1.3 allows remote authenticated users to read all OS files via crafted CLI commands.Check if you run itEPSS 0.53%Jul 2, 2025
- Medium6.1The WP Front-end login and register plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the email and wpmp_reset_password_token parameters in all versions up tCheck if you run itEPSS 0.24%Jul 2, 2025
- Medium6.1The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to DOM-Based Reflected Cross-Site Scripting via the ‘pdf-source’ parameter iCheck this weekEPSS 32.00%Jul 1, 2025
- Medium5.4Sunshine is a self-hosted game stream host for Moonlight.Check this weekEPSS 24.00%Jul 1, 2025
- High8.2The Janssen Project is an open-source identity and access management (IAM) platform.Check this weekEPSS 41.00%Jul 1, 2025
- High8.7Frappe is a full-stack web application framework.Check this weekEPSS 45.00%Jun 30, 2025
- Low2.3Host Header Injection (HHI) vulnerability in the Hotspot Shield VPN client, which can induce unexpected behaviour when accessing third-party web applications through the VPN tunnelCheck this weekEPSS 32.00%Jun 30, 2025
- Medium5.3A vulnerability, which was classified as critical, has been found in D-Link DI-7300G+ 19.12.25A1.Check this weekEPSS 16.54%Jun 30, 2025
- Critical9.8In the Linux kernel, the following vulnerability has been resolved: sunrpc: handle SVC_GARBAGE during svc auth processing as auth error tianshuo han reported a remotely-triggerableCheck if you run itEPSS 0.55%Jun 30, 2025
- High7.5A Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) vulnerability in the UCRM Client Signup Plugin (v1.3.4 and earlier) could allow privilege escalation if anCheck if you run itEPSS 0.17%Jun 29, 2025
- Medium5.1A vulnerability was found in SourceCodester Simple Company Website 1.0.Check this weekEPSS 43.00%Jun 29, 2025
- Medium6.5A specific flaw exists within the Bluetooth stack of the MIB3 infotainment.Check if you run itEPSS 0.38%Jun 28, 2025
- Medium4.3The MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incCheck this weekEPSS 17.00%Jun 28, 2025
- Medium5.4IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim.Check if you run itEPSS 0.23%Jun 28, 2025
- Medium5.4IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim.Check if you run itEPSS 0.24%Jun 28, 2025
- High7.6A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions.Check this weekEPSS 26.00%Jun 27, 2025
- High7.2The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due to insufficient inputCheck this weekEPSS 31.00%Jun 26, 2025
- Low2.4Versions of the package snyk before 1.1297.3 are vulnerable to Insertion of Sensitive Information into Log File through local Snyk CLI debug logs.Check this weekEPSS 18.00%Jun 26, 2025
- UnknownImproper Input ValidationPatch nowKEVEPSS 0.55%Jun 26, 2025
- Medium5.3A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884.Check if you run itEPSS 2.44%Jun 25, 2025