Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Zoho Flow Zoho Flow zoho-flow allows Cross Site Request Forgery.This issue affects Zoho Flow: from n/a through <= 2.14.1.Check if you run itEPSS 0.14%Sep 22, 2025
- Medium5.3Missing Authorization vulnerability in Heureka Group Heureka heureka allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Heureka: from n/a through <=Check if you run itEPSS 0.36%Sep 22, 2025
- High7.2Deserialization of Untrusted Data vulnerability in ConveyThis ConveyThis conveythis-translate allows Object Injection.This issue affects ConveyThis: from n/a through <= 269.1.Check if you run itEPSS 0.67%Sep 22, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Photo Gallery by Ays gallery-photo-gallery allows DOM-Based XSS.This iCheck if you run itEPSS 0.28%Sep 22, 2025
- Medium5.4Missing Authorization vulnerability in Clariti Clariti clariti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clariti: from n/a throughCheck if you run itEPSS 0.29%Sep 22, 2025
- Medium5.3Missing Authorization vulnerability in memberful Memberful - Membership Plugin memberful-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MembeCheck if you run itEPSS 0.27%Sep 22, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Fastly Fastly fastly allows Cross Site Request Forgery.This issue affects Fastly: from n/a through <= 1.2.28.Check if you run itEPSS 0.14%Sep 22, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PlayerJS PlayerJS playerjs allows DOM-Based XSS.This issue affects PlayerJS: fCheck if you run itEPSS 0.21%Sep 22, 2025
- Medium5.3Missing Authorization vulnerability in AppMySite AppMySite appmysite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AppMySite: from n/aCheck if you run itEPSS 0.28%Sep 22, 2025
- Medium6.5Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutentor: from n/a throCheck if you run itEPSS 0.32%Sep 22, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tapfiliate Tapfiliate tapfiliate allows Stored XSS.This issue affects TapfiliaCheck if you run itEPSS 0.21%Sep 22, 2025
- High7.5Authlib is a Python library which builds OAuth and OpenID Connect servers.Check if you run itEPSS 0.26%Sep 22, 2025
- Medium5.3A vulnerability was found in MuYuCMS up to 2.7.Check if you run itEPSS 0.33%Sep 22, 2025
- Low2.3A vulnerability has been found in Smartstore up to 6.2.0.Check if you run itEPSS 0.25%Sep 22, 2025
- Medium5.8Profession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api/challenges/{id} and also URLs for eversports, the user-management page, and the plane paCheck if you run itEPSS 0.27%Sep 22, 2025
- Medium5.3A vulnerability was determined in academico-sis academico up to d9a9e2636fbf7e5845ee086bcb03ca62faceb6ab.Check if you run itEPSS 0.36%Sep 21, 2025
- Medium6.3A vulnerability has been found in Harness 3.3.0.Check if you run itEPSS 0.49%Sep 21, 2025
- Medium5.3A flaw has been found in Harness 3.3.0.Check if you run itEPSS 0.34%Sep 21, 2025
- Medium4.8A security vulnerability has been detected in htmly up to 3.1.0.Check if you run itEPSS 0.30%Sep 21, 2025
- High7.2Mattermost versions 10.8.x <= 10.8.3, 10.5.x <= 10.5.8, 9.11.x <= 9.11.17, 10.10.x <= 10.10.1, 10.9.x <= 10.9.3 fail to validate import directory path configuration wh…Check if you run itEPSS 0.64%Sep 19, 2025
- Medium6.5Mattermost versions 10.5.x <= 10.5.8, 9.11.x <= 9.11.17 fail to properly validate access controls which allows any authenticated user to download sensitive files via board file dowCheck if you run itEPSS 0.27%Sep 19, 2025
- High8.9MapServer is a system for developing web-based GIS applications.Check if you run itEPSS 0.41%Sep 19, 2025
- High7.7AliasVault is a privacy-first password manager with built-in email aliasing.Check if you run itEPSS 0.33%Sep 19, 2025
- Medium6.5Tenda ac6_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')Patch nowKEVEPSS 3.29%Sep 19, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: fs: writeback: fix use-after-free in __mark_inode_dirty() An use-after-free issue occurred when __mark_inode_dirCheck if you run itEPSS 0.31%Sep 19, 2025
Sort