Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.4A flaw was found in Quay.Check if you run itEPSS 0.21%Oct 12, 2026
- Low2.1A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0.Check if you run itEPSS 0.26%Oct 12, 2026
- High8.5Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations.Check if you run itEPSS 0.29%Oct 12, 2026
- Medium5.3Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRST_NAME regist…Check if you run itEPSS 0.20%Oct 12, 2026
- Medium5.3Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll.Check if you run itEPSS 0.20%Oct 12, 2026
- Medium6.9Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the c…Check if you run itEPSS 0.27%Oct 12, 2026
- Medium6.0Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user c…Open the advisoryOct 12, 2026
- High8.7Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators.Check if you run itEPSS 0.48%Oct 12, 2026
- High8.4Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by up…Check if you run itEPSS 0.26%Oct 12, 2026
- High8.6Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in d…Check if you run itEPSS 0.32%Oct 12, 2026
- Critical9.6Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perfo…Check if you run itEPSS 0.31%Oct 12, 2026
- High8.4Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrat…Check if you run itEPSS 0.33%Oct 12, 2026
- Critical9.9Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path.Check if you run itEPSS 0.35%Oct 12, 2026
- Critical9.9Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations.Check if you run itEPSS 0.35%Oct 12, 2026
- Medium5.3QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController,…Open the advisoryOct 12, 2026
- Medium6.4A flaw was found in Red Hat Quay.Check if you run itEPSS 0.17%Oct 12, 2026
- High8.8ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1Check if you run itEPSS 0.36%Oct 12, 2026
- Critical9.2LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization HeaderCheck if you run itEPSS 0.46%Oct 12, 2026
- High8.6Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH BypassCheck if you run itEPSS 0.65%Oct 12, 2026
- Medium5.1Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.phpCheck if you run itEPSS 0.21%Oct 12, 2026
- Medium5.3Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin ViewsCheck if you run itEPSS 0.20%Oct 12, 2026
- Critical9.3Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic .Check if you run itEPSS 0.40%Oct 12, 2026
- High8.6Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access GrantsCheck if you run itEPSS 0.36%Oct 12, 2026
- Low2.1Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA VerificationCheck if you run itEPSS 0.18%Oct 12, 2026
- High7.6Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode ConnectionsCheck if you run itEPSS 0.32%Oct 12, 2026