Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.7Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's…Check if you run itEPSS 0.14%Oct 12, 2026
- Low1.9A weakness has been identified in Edimax BR-6208AC 1.32.Check if you run itEPSS 0.25%Oct 12, 2026
- High8.6Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowi…Check if you run itEPSS 0.27%Oct 12, 2026
- Medium6.3Frappe before 14.99.2 and 15.x before 15.86.0 contains an LDAP injection vulnerability because certain endpoints do not sanitize user-supplied parameters before using…Check if you run itEPSS 0.25%Oct 12, 2026
- Medium5.1Frappe before 14.99.10 and 15.x before 15.91.1 contains a stored cross-site scripting vulnerability in the leaderboard page because user names are rendered without pro…Open the advisoryOct 12, 2026
- High7.1Frappe before 13.46.3 and 14.x before 14.21.1 contains an improper access control vulnerability in Email Template permissions that allows any authenticated non-guest u…Check if you run itEPSS 0.22%Oct 12, 2026
- Medium5.3Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a missing permission check.Check if you run itEPSS 0.19%Oct 12, 2026
- Medium6.9Frappe 14.x before 14.45.0 contains an information disclosure vulnerability that allows users with error log access to view secrets stored in local variables captured…Check if you run itEPSS 0.31%Oct 12, 2026
- Medium6.9Frappe before 14.59.0 and 15.x before 15.5.0 contains a sandbox flaw where the frappe.flags.in_safe_exec global flag can become False during Server Script execution wh…Check if you run itEPSS 0.32%Oct 12, 2026
- High7.1Nginx UI is a web user interface for the Nginx web server.Check if you run itEPSS 0.18%Oct 12, 2026
- Medium5.1Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform.Check if you run itEPSS 0.24%Oct 12, 2026
- Medium5.9GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader.Check if you run itEPSS 0.15%Oct 12, 2026
- Medium5.7Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities.Check if you run itEPSS 0.13%Oct 12, 2026
- Medium4.3Convex is an open-source reactive database for application developers.Check if you run itEPSS 0.17%Oct 12, 2026
- High8.8Nginx UI is a web user interface for the Nginx web server.Check if you run itEPSS 0.43%Oct 12, 2026
- Critical9.1Netherman Portal del Hermano (portaldelhermano.es) before 2026-10-06 contains a broken authentication vulnerability in its password-recovery flow at the POST /password…Check if you run itEPSS 0.40%Oct 12, 2026
- High8.7IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image r…Check if you run itEPSS 0.23%Oct 12, 2026
- Medium6.5IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image c…Check if you run itEPSS 0.23%Oct 12, 2026
- High8.6Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users…Check if you run itEPSS 0.33%Oct 12, 2026
- High8.7N3.js before 2.11.1 contains a regular expression denial of service vulnerability in the N3Lexer number pattern that backtracks quadratically on long digit runs.Check if you run itEPSS 0.35%Oct 12, 2026
- Medium5.3SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and…Check if you run itEPSS 0.22%Oct 12, 2026
- High8.4EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script through notebook names or memo titles.Check if you run itEPSS 0.33%Oct 12, 2026
- Medium5.3ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods.Check if you run itEPSS 0.25%Oct 12, 2026
- Low2.1A weakness has been identified in itsourcecode Baptism Information Management System 1.0.Check if you run itEPSS 0.25%Oct 12, 2026
- Medium6.0Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite.Check if you run itEPSS 0.14%Oct 12, 2026