Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admi…Check if you run itEPSS 0.29%May 5, 2026
- Medium5.1AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads throu…Check if you run itEPSS 0.27%May 5, 2026
- High8.7ERPGo SaaS 3.9 contains a CSV injection vulnerability that allows authenticated attackers to inject spreadsheet formulas into vendor name fields that execute on the wo…Check if you run itEPSS 0.35%May 5, 2026
- High8.7OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the…Check if you run itEPSS 0.54%May 5, 2026
- High8.7WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by…Check if you run itEPSS 0.31%May 5, 2026
- High8.7Frappe Framework ERPNext 13.4.0 contains a sandbox escape vulnerability in RestrictedPython that allows authenticated users with System Manager role to execute arbitra…Check if you run itEPSS 0.61%May 5, 2026
- Critical9.3Eclipse Equinox OSGi 3.7.2 and earlier contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary commands by sending pa…Check if you run itEPSS 0.55%May 5, 2026
- Critical9.3Eclipse Equinox OSGi versions 3.8 through 3.18 contain a remote code execution vulnerability in the console interface that allows unauthenticated attackers to execute…Check if you run itEPSS 0.46%May 5, 2026
- High7.5fast-uri normalize() decoded percent-encoded authority delimiters inside the host component and then re-emitted them as raw delimiters during serialization.Check if you run itEPSS 0.51%May 5, 2026
- Medium6.5RouterOS provides various services that rely on correct verification of client and server certificates to secure confidentiality and integrity of communications.Check if you run itEPSS 0.19%May 5, 2026
- High7.3Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HT…Check if you run itEPSS 0.38%May 5, 2026
- Medium5.3Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.Check if you run itEPSS 0.71%May 5, 2026
- Medium4.3The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the function in all ver…Check if you run itEPSS 0.30%May 5, 2026
- High7.5The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to SQL Injection via the 'inputs' parameter in versions u…Check if you run itEPSS 0.36%May 5, 2026
- High7.3Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.Check if you run itEPSS 0.63%May 5, 2026
- Medium5.9An issue was discovered in the PaperCut Hive Ricoh embedded application.Check if you run itEPSS 0.24%May 5, 2026
- Medium4.6An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4).Check if you run itEPSS 0.56%May 5, 2026
- Medium4.1A race condition exists in PaperCut MF when processing badge-swipe data from certain HP multifunction devices.Check if you run itEPSS 0.34%May 5, 2026
- High7.5The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 1.52.1 v…Check if you run itEPSS 0.77%May 5, 2026
- Critical9.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saleswonder LLC WebinarIgnition allows Blind SQL Injection.Check if you run itEPSS 0.35%May 5, 2026
- Medium6.5The GenerateBlocks plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.0.Check if you run itEPSS 0.54%May 5, 2026
- Medium5.3The Forminator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.52.0.Check if you run itEPSS 0.37%May 5, 2026
- High8.9A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521.Check if you run itEPSS 1.79%May 5, 2026
- Low2.1A vulnerability was identified in itsourcecode Courier Management System 1.0.Check if you run itEPSS 0.20%May 5, 2026
- Medium5.5A vulnerability was found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8.Check if you run itEPSS 1.47%May 5, 2026
Sort