Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1.Check if you run itEPSS 0.35%Apr 7, 2026
- High8.6Dolibarr ERP/CRM versions prior to 23.0.2 contain an authenticated remote code execution vulnerability in the dol_eval_standard() function that fails to apply forbidden string checCheck this weekEPSS 15.79%Apr 7, 2026
- High8.3Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rules when served via script_alias.Check if you run itEPSS 0.57%Apr 7, 2026
- High7.6Improper Certificate Validation vulnerability in Erlang OTP public_key (pubkey_ocsp module) allows OCSP designated-responder authorization bypass via missing signature verificationCheck if you run itEPSS 0.21%Apr 7, 2026
- Critical9.6A vulnerability has been identified in the graphical user interface (GUI) of HPE Aruba Networking Private 5G Core On-Prem that could allow an attacker to abuse an open redirect vulCheck if you run itEPSS 0.33%Apr 7, 2026
- Critical9.3Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows a site user to escalCheck if you run itEPSS 0.12%Apr 7, 2026
- High8.7Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c.Check if you run itEPSS 0.58%Apr 7, 2026
- Medium5.1Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its page creating functionality.Check if you run itEPSS 0.16%Apr 7, 2026
- Medium4.3Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Client, Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ Web,…Check if you run itEPSS 0.43%Apr 7, 2026
- Medium5.4Missing Authorization vulnerability in OceanWP Ocean Extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ocean Extra: from n/a throughCheck if you run itEPSS 0.30%Apr 7, 2026
- Medium5.3Missing Authorization vulnerability in Eniture technology LTL Freight Quotes – Worldwide Express Edition allows Exploiting Incorrectly Configured Access Control Security Levels.ThiCheck if you run itEPSS 0.25%Apr 7, 2026
- High7.5Cross-Site Request Forgery (CSRF) vulnerability in Analytify Simple Social Media Share Buttons allows Cross Site Request Forgery.This issue affects Simple Social Media Share ButtonCheck if you run itEPSS 0.12%Apr 7, 2026
- High7.5Cross-Site Request Forgery (CSRF) vulnerability in Analytify Under Construction, Coming Soon & Maintenance Mode allows Cross Site Request Forgery.This issue affects Under ConstructCheck if you run itEPSS 0.12%Apr 7, 2026
- Medium6.3Generation of Predictable Numbers or Identifiers vulnerability in Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache Poisoning.Check if you run itEPSS 0.28%Apr 7, 2026
- Medium5.3The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to Insufficient Verification of Data Authenticity inCheck if you run itEPSS 0.17%Apr 7, 2026
- High8.8The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.3.Check if you run itEPSS 0.64%Apr 7, 2026
- Critical9.8In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing JSON Web Tokens (JWTCheck if you run itEPSS 0.51%Apr 7, 2026
- Medium6.5The SQL Chart Builder WordPress plugin before 2.3.8 does not properly escape user input as it is concatened to SQL queries, making it possible for attackers to conduct SQL InjectioCheck if you run itEPSS 0.19%Apr 7, 2026
- Medium6.5The Link Whisper Free WordPress plugin before 0.9.1 has a publicly accessible REST endpoint that allows unauthenticated settings updates.Check if you run itEPSS 0.19%Apr 7, 2026
- Medium5.4The Popup Box WordPress plugin before 5.5.0 does not properly validate nonces in the add_or_edit_popupbox() function before saving popup data, allowing unauthenticated attackers toCheck if you run itEPSS 0.14%Apr 7, 2026
- Medium5.5Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT DesktopCheck if you run itEPSS 0.14%Apr 7, 2026
- High7.8A vulnerability in the HuggingFace Transformers library, specifically in the class, allows for arbitrary code execution.Check if you run itEPSS 0.39%Apr 7, 2026
- Critical9.8Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT DCheck if you run itEPSS 0.62%Apr 7, 2026
- Medium4.3In sec boot, there is a possible out of bounds write due to an integer overflow.Check if you run itEPSS 0.19%Apr 7, 2026
- High8.8In Modem, there is a possible out of bounds write due to a missing bounds check.Check if you run itEPSS 0.31%Apr 7, 2026
Sort