Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platform are ab…Check if you run itEPSS 0.43%May 8, 2026
- High8.1Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned.Check if you run itEPSS 0.37%May 8, 2026
- High8.1The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0.Check if you run itEPSS 0.51%May 8, 2026
- Medium6.5The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0.Check if you run itEPSS 0.53%May 8, 2026
- Medium6.5The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0.Check if you run itEPSS 0.49%May 8, 2026
- Critical9.2DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote attacke…Check if you run itEPSS 1.43%May 8, 2026
- Critical9.8OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthenticated attacker to craft commands that will e…Check if you run itEPSS 2.85%May 8, 2026
- Critical9.3Weak credentials in the CashDro 3 web administration panel, version 24.01.00.26, where the platform allows the use of numeric PINs for user authentication.Check if you run itEPSS 0.32%May 8, 2026
- Medium5.3Open redirection vulnerability in the latest demo version of the Cradle eCommerce platform.Check if you run itEPSS 0.34%May 8, 2026
- Medium6.4The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the shortcode in all versions up…Check if you run itEPSS 0.24%May 8, 2026
- Medium6.4The Sky Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom post type in all versions up to, and including, 3.3.2.Check if you run itEPSS 0.24%May 8, 2026
- Critical10.0A vulnerability in Remote Spark SparkView before build 1122 allows an attacker to bypasses the local connection check and achieve arbitrary code execution as root on t…Check if you run itEPSS 0.33%May 8, 2026
- Medium6.4The NMR Strava activities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 1.0.14 due…Check if you run itEPSS 0.27%May 8, 2026
- High7.2The Auto Affiliate Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 6.8.8 This is due to insufficient input sa…Check if you run itEPSS 0.38%May 8, 2026
- High8.8The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to Deserialization of Untrus…Check if you run itEPSS 0.95%May 8, 2026
- Medium5.3In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal.Check if you run itEPSS 0.21%May 8, 2026
- Medium5.3In uriparser before 1.0.2, there is pointer difference truncation to int in various places.Check if you run itEPSS 0.21%May 8, 2026
- Critical9.1Apache::Session versions through 1.94 for Perl re-creates deleted sessions.Check if you run itEPSS 0.36%May 8, 2026
- Medium5.1A vulnerability in Legion of the Bouncy Castle Inc.Check if you run itEPSS 0.16%May 8, 2026
- High8.5PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protoco…Check if you run itEPSS 0.12%May 8, 2026
- High8.6The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before using it in a SQL statement, which could allow…Check if you run itEPSS 0.26%May 8, 2026
- Low3.0In OpenStack Ironic before 35.0.2 (in a certain non-default configuration), instance_info['ks_template'] is rendered without sandboxing.Check if you run itEPSS 0.34%May 8, 2026
- Critical9.9Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php.Check if you run itEPSS 0.68%May 8, 2026
- Critical9.1Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property.Check if you run itEPSS 0.81%May 8, 2026
- Critical9.8RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable.Check if you run itEPSS 0.39%May 8, 2026
Sort