Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.2Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the remote_url parameter in the remote directory scan endpoint (POST /v1/{iac}/{ia…Check if you run itEPSS 0.48%May 19, 2026
- High8.7Terrascan v1.18.3 and prior are vulnerable to Server-Side Request Forgery (SSRF) via the webhook_url parameter in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{…Check if you run itEPSS 0.50%May 19, 2026
- Critical9.8An authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up to and including v7.7.Check if you run itEPSS 1.27%May 19, 2026
- High8.8A command injection vulnerability exists in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to and including v7.7.Check if you run itEPSS 1.67%May 19, 2026
- Medium5.4A command injection vulnerability exists in Panabit PAP-XM320 up to and including V7.7.Check if you run itEPSS 0.74%May 19, 2026
- Medium6.5Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the re…Check if you run itEPSS 0.19%May 19, 2026
- High8.4An improper authentication vulnerability was discovered in the Motorola Factory Test component (com.motorola.motocit).Check if you run itEPSS 0.31%May 19, 2026
- Critical9.8An OS command injection vulnerability in the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 allows remote attackers to execute arbitrary commands via…Check if you run itEPSS 1.62%May 19, 2026
- Critical9.8The JSONSerializer and CBORSerializer in APScheduler (all versions including 3.10.x and 4.0.0a5) are vulnerable to Remote Code Execution (RCE) via Insecure Deserialization.Check if you run itEPSS 0.81%May 19, 2026
- Critical9.1API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware.Check if you run itEPSS 0.55%May 19, 2026
- Critical9.8The LalanaChami Pharmacy Management System (commit 5c3d028) allows unauthenticated remote attackers to escalate privileges by self-assigning an administrative role dur…Check if you run itEPSS 0.48%May 19, 2026
- High8.8BillaBear (all versions prior to Jan 2026) contains a SQL Injection vulnerability in the EventRepository.Check if you run itEPSS 0.36%May 19, 2026
- Critical9.8scalar/astro v0.1.13 was discovered to contain a Server-Side Request Forgery (SSRF) in the scalar_url query parameter of the Scalar Proxy endpoint.Check if you run itEPSS 0.47%May 19, 2026
- Critical9.8scalar/astro v0.1.13 was discovered to contain an arbitrary file upload vulnerability in the the scalar_url query parameter of the Scalar Proxy endpoint.Check if you run itEPSS 0.53%May 19, 2026
- Medium4.1SSRF in Media External-Link Endpoint Bypasses IP ValidationCheck if you run itEPSS 0.37%May 19, 2026
- Medium4.9Stored XSS via SVG file upload — no SVG sanitizationCheck if you run itEPSS 0.48%May 19, 2026
- Medium4.3Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-paymentCheck if you run itEPSS 0.41%May 19, 2026
- Medium6.5Admin API ACL Bypass in Order State Transition EndpointsCheck if you run itEPSS 0.39%May 19, 2026
- Medium4.3Shopware SSO referer trust leading to an arbitrary redirect targetCheck if you run itEPSS 0.27%May 19, 2026
- Medium6.5Privilege escalation: non-admin user with user:create ACL can create admin accountsCheck if you run itEPSS 0.47%May 19, 2026
- Critical9.2NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*,…Check if you run itEPSS 9.69%May 19, 2026
- Medium6.9Technitium DNS Server aggressively tries to fetch missing RRSIG records or mismatched DNSKEY records.Check if you run itEPSS 0.39%May 19, 2026
- Critical9.3Tyler Identity Local (TID-L) uses documented, default administrative credentials.Check if you run itEPSS 0.48%May 19, 2026
- High8.7HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by s…Check if you run itEPSS 0.24%May 19, 2026
- Medium5.3An issue was discovered in the Portrait Dell Color Management application before 3.7.0 for Dell monitors.Check if you run itEPSS 0.14%May 19, 2026
Sort