Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.0Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentially resulting in unauthoriz…Check if you run itEPSS 0.17%May 14, 2026
- Medium6.3Missing authentication in the KVM key download endpoint could allow an unauthenticated attacker with knowledge of the exposed URL to retrieve sensitive keys, potential…Check if you run itEPSS 0.32%May 14, 2026
- High8.8SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ...Check if you run itEPSS 0.18%May 14, 2026
- High8.8Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database.Check if you run itEPSS 0.37%May 14, 2026
- Medium4.3Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array.Check if you run itEPSS 0.21%May 14, 2026
- High7.5Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service.Check if you run itEPSS 0.60%May 14, 2026
- Medium6.5Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate.Check if you run itEPSS 0.56%May 14, 2026
- High8.8Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the ser…Check if you run itEPSS 0.45%May 14, 2026
- High7.2SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser.Check if you run itEPSS 0.29%May 14, 2026
- High8.8Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g.Check if you run itEPSS 0.41%May 14, 2026
- Medium4.3Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones.Check if you run itEPSS 0.21%May 14, 2026
- High8.8Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds.Check if you run itEPSS 1.01%May 14, 2026
- Medium5.4Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types.Check if you run itEPSS 0.16%May 14, 2026
- Medium5.1WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint.Check if you run itEPSS 0.43%May 14, 2026
- High8.8Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc.Check if you run itEPSS 0.30%May 14, 2026
- Medium6.8Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd.Check if you run itEPSS 0.22%May 14, 2026
- High7.1Unsafe object reference (IDOR) in Stel Order v3.25.1 and earlier versions, specifically in the ‘/app/FrontController’ endpoint, through manipulation of the ‘employeeID’ parameter.Check if you run itEPSS 0.21%May 14, 2026
- Medium5.1Stored Cross-Site Scripting (XSS) in Stel Order v3.25.1 and earlier, located at the ‘/app/FrontController’ endpoint via the ‘legalName’ and ‘employeeID’ parameters.Check if you run itEPSS 0.26%May 14, 2026
- High7.5The Database Backup for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.2.Check if you run itEPSS 0.49%May 14, 2026
- High8.1The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized arbitrary file read and deletion in all versions up to, and including, 2.5.2.Check if you run itEPSS 0.46%May 14, 2026
- High7.5The Database Backup for WordPress plugin for WordPress is vulnerable to unauthorized database export in all versions up to, and including, 2.5.2.Check if you run itEPSS 0.41%May 14, 2026
- Medium5.1podinfo through 6.11.2 contains a reflected cross-site scripting vulnerability in the /echo and /api/echo endpoints where the echoHandler writes request body content d…Check if you run itEPSS 0.19%May 14, 2026
- High8.8Authorization bypass through User-Controlled key vulnerability in APPYAP Technology and Information Inc.Check if you run itEPSS 0.24%May 14, 2026
- Medium5.3Uncontrolled Recursion vulnerability in Apache Commons.Check if you run itEPSS 0.47%May 14, 2026
- High8.2Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.Check if you run itEPSS 0.62%May 14, 2026
Sort