Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.1A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JCheck if you run itEPSS 0.40%Apr 8, 2026
- Medium5.3A vulnerability was identified in SourceCodester Online Food Ordering System 1.0.Check if you run itEPSS 0.25%Apr 8, 2026
- Medium5.1A flaw has been found in SourceCodester Sales and Inventory System 1.0.Check if you run itEPSS 0.25%Apr 8, 2026
- High7.1OpenClaw before 2026.4.8 contains a request body replay vulnerability in fetchWithSsrFGuard that allows unsafe request bodies to be resent across cross-origin redirects.Check if you run itEPSS 0.32%Apr 8, 2026
- High8.7Unfurl before 2026.04 contains an unbounded zlib decompression vulnerability in parse_compressed.py that allows remote attackers to cause denial of service.Check if you run itEPSS 0.52%Apr 8, 2026
- Critical9.3Unfurl through 2025.08 contains an improper input validation vulnerability in config parsing that enables Flask debug mode by default.Check if you run itEPSS 0.57%Apr 8, 2026
- High8.5UAC (Unix-like Artifacts Collector) before 3.3.0-rc1 contains a command injection vulnerability in the placeholder substitution and command execution pipeline where the _run_commanCheck if you run itEPSS 0.74%Apr 8, 2026
- High8.5MemProcFS before 5.17 contains multiple unsafe library-loading patterns that enable DLL and shared-library hijacking across six attack surfaces, including bare-name LoadLibraryU anCheck if you run itEPSS 0.14%Apr 8, 2026
- High8.4parseusbs before 1.9 contains an OS command injection vulnerability where the volume listing path argument (-v flag) is passed unsanitized into an os.popen() shell command with ls,Check if you run itEPSS 0.76%Apr 8, 2026
- High8.5parseusbs before 1.9 contains an OS command injection vulnerability in parseUSBs.py where LNK file paths are passed unsanitized into an os.popen() shell command, allowing arbitraryCheck if you run itEPSS 0.82%Apr 8, 2026
- Medium5.1Hayabusa versions prior to 3.8.0 contain a cross-site scripting (XSS) vulnerability in its HTML report output that allows an attacker to execute arbitrary JavaScript when a user scCheck if you run itEPSS 0.21%Apr 8, 2026
- High8.4ALEAPP (Android Logs Events And Protobuf Parser) through 3.4.0 contains a path traversal vulnerability in the NQ_Vault.py artifact parser that uses attacker-controlled file_name_frCheck if you run itEPSS 0.19%Apr 8, 2026
- Medium4.8The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the ISO9660 filesystem parser where the parse_susp() function trusts len_id, len_des, and len_src fielCheck if you run itEPSS 0.14%Apr 8, 2026
- Medium4.8The Sleuth Kit through 4.14.0 contains an out-of-bounds read vulnerability in the APFS filesystem keybag parser where the wrapped_key_parser class follows attacker-controlled lengtCheck if you run itEPSS 0.13%Apr 8, 2026
- High8.4The Sleuth Kit through 4.14.0 contains a path traversal vulnerability in tsk_recover that allows an attacker to write files to arbitrary locations outside the intended recovery dirCheck if you run itEPSS 0.21%Apr 8, 2026
- Medium5.3A vulnerability was detected in openstatusHQ openstatus up to 1b678e71a85961ae319cbb214a8eae634059330c.Check if you run itEPSS 0.29%Apr 8, 2026
- Medium6.4The Post Blocks & Tools plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sliderStyle' block attribute in the Posts Slider block in all versions up to, andCheck if you run itEPSS 0.19%Apr 8, 2026
- Medium4.3Inappropriate implementation in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to leak cross-origin data viaCheck if you run itEPSS 0.16%Apr 8, 2026
- Medium4.3Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass content security policy via a crafted HTML page.Check if you run itEPSS 0.17%Apr 8, 2026
- High8.1Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted video file.Check if you run itEPSS 0.20%Apr 8, 2026
- Medium4.3Incorrect security UI in Omnibox in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML pageCheck if you run itEPSS 0.17%Apr 8, 2026
- Medium6.5Incorrect security UI in Permissions in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to perform domain spoofing via a crafted HTML page.Check if you run itEPSS 0.19%Apr 8, 2026
- Medium6.5Policy bypass in IFrameSandbox in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restricCheck if you run itEPSS 0.27%Apr 8, 2026
- Critical9.8Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream metadata via a crafted HCheck if you run itEPSS 0.22%Apr 8, 2026
- Medium6.5Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to bypass enterprise hCheck if you run itEPSS 0.14%Apr 8, 2026
Sort