Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8The Trash Restore CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to restore deleted content from the trash to unauthorized locations through CSRF.Check if you run itEPSS 0.15%Mar 18, 2026
- Medium6.5MuraCMS through 10.1.10 contains a CSRF vulnerability in the bundle creation functionality (csettings.cfc createBundle method) that allows unauthenticated attackers to…Check if you run itEPSS 0.19%Mar 18, 2026
- High8.0MuraCMS through 10.1.10 contains a CSRF vulnerability in the Add To Group functionality for user management (cUsers.cfc addToGroup method) that allows attackers to esc…Check if you run itEPSS 0.15%Mar 18, 2026
- High8.8The import form CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to upload and install malicious form definitions through a CSRF attack.Check if you run itEPSS 0.19%Mar 18, 2026
- High8.2The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the REST API endpoint in all versCheck if you run itEPSS 0.29%Mar 18, 2026
- High7.2The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site ScriptingCheck if you run itEPSS 0.27%Mar 18, 2026
- High7.3The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2.Check if you run itEPSS 0.49%Mar 18, 2026
- Medium5.3The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the function in all versions up to, and including, 3.8.0.Check if you run itEPSS 0.26%Mar 18, 2026
- Medium6.4The Code Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom field meta values in all versions up to, and including, 2.5.1.Check if you run itEPSS 0.23%Mar 18, 2026
- High7.5Glances is an open-source system cross-platform monitoring tool.Check if you run itEPSS 0.55%Mar 18, 2026
- High8.8Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives, allowing crafted archives to write fileCheck if you run itEPSS 2.26%Mar 18, 2026
- High7.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ ZENworks Service Desk allows Cross-Site Scripting (XSS).Check if you run itEPSS 0.16%Mar 18, 2026
- Medium6.6In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of…Check if you run itEPSS 0.31%Mar 18, 2026
- Critical9.8Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.Check if you run itEPSS 0.38%Mar 18, 2026
- High8.8In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content,…Check if you run itEPSS 0.35%Mar 18, 2026
- Medium6.5An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform…Check if you run itEPSS 0.19%Mar 18, 2026
- Medium5.3A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret.Check if you run itEPSS 0.26%Mar 18, 2026
- Critical9.0In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API.Check if you run itEPSS 0.26%Mar 18, 2026
- High8.0LibreChat version 0.8.1-rc2 uses the same JWT secret for the user session mechanism and RAG API which compromises the service-level authentication of the RAG API.Check if you run itEPSS 0.38%Mar 18, 2026
- High8.7libp2p-rust is the official rust language Implementation of the libp2p networking stack.Check if you run itEPSS 0.60%Mar 18, 2026
- Medium5.3beefree.io SDK is vulnerable to Stored XSS in Social Media icon URL parameter in email builder functionality.Check if you run itEPSS 0.33%Mar 18, 2026
- Medium5.3Missing Authorization vulnerability in Ajay Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.T…Check if you run itEPSS 0.22%Mar 18, 2026
- Medium5.4The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_handler() a…Check if you run itEPSS 0.20%Mar 18, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix refcount bug and potential UAF in perf_mmap Syzkaller reported a refcount_t: addition on 0; use-aCheck if you run itEPSS 0.14%Mar 18, 2026
- Medium5.5In the Linux kernel, the following vulnerability has been resolved: tcp: secure_seq: add back ports to TS offset This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timesCheck if you run itEPSS 0.18%Mar 18, 2026
Sort