Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in delete_module.php that allows authenticated attackers to inject arbitrary Ja…Check if you run itEPSS 0.29%May 21, 2026
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in db_loader.php that allows authenticated attackers to inject arbitrary JavaSc…Check if you run itEPSS 0.29%May 21, 2026
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in circle.php that allows authenticated attackers to inject arbitrary JavaScrip…Check if you run itEPSS 0.29%May 21, 2026
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add_nm.php that allows authenticated attackers to inject arbitrary JavaScrip…Check if you run itEPSS 0.29%May 21, 2026
- Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in add.php that allows authenticated attackers to inject arbitrary JavaScript b…Check if you run itEPSS 0.29%May 21, 2026
- High8.4Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allows authe…Check if you run itEPSS 0.47%May 20, 2026
- Medium5.3Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to l…Check if you run itEPSS 0.28%May 20, 2026
- High7.5Type Confusion in GFX in Google Chrome on Linux, ChromeOS prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to potentially per…Check if you run itEPSS 0.26%May 20, 2026
- Medium4.2Inappropriate implementation in UI in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to perform UI…Check if you run itEPSS 0.21%May 20, 2026
- High7.4Yii 2 is a PHP application framework.Check if you run itEPSS 0.50%May 20, 2026
- Medium6.1CryptPad is an end-to-end encrypted collaborative office suite.Check if you run itEPSS 0.29%May 20, 2026
- Medium6.1Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a crafted .txt file.Check if you run itEPSS 0.31%May 20, 2026
- Critical9.5Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx temp…Check if you run itEPSS 2.06%May 20, 2026
- High8.7Twig versions 2.16.x and 3.9.0 through 3.25.x contain a sandbox bypass vulnerability when using a SourcePolicyInterface that allows attackers with template rendering c…Check if you run itEPSS 0.76%May 20, 2026
- Medium4.3The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in…Check if you run itEPSS 0.20%May 20, 2026
- High7.4mailcow-dockerized contains a stored cross-site scripting vulnerability in the administrator Queue Manager.Check if you run itEPSS 0.41%May 20, 2026
- Medium4.4The General Options plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.1.0.Check if you run itEPSS 0.31%May 20, 2026
- Medium6.1The Word 2 Cash plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in versions up to and including 0.9.2.Check if you run itEPSS 0.18%May 20, 2026
- Medium4.8CtrlPanel is open-source billing software for hosting providers.Check if you run itEPSS 0.27%May 19, 2026
- High8.7CtrlPanel is open-source billing software for hosting providers.Check if you run itEPSS 0.45%May 19, 2026
- Medium6.5Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the re…Check if you run itEPSS 0.23%May 19, 2026
- Critical9.6A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gadget handler.Check if you run itEPSS 0.67%May 19, 2026
- Medium5.1A Stored HTML Injection vulnerability was discovered in the Smart Polling functionality due to improper validation of an input parameter.Check if you run itEPSS 0.19%May 19, 2026
- Medium4.8A Stored HTML Injection vulnerability was discovered in the Schedule Restore Archive functionality due to improper validation of an input parameter.Check if you run itEPSS 0.19%May 19, 2026
- Medium4.8A Stored HTML Injection vulnerability was discovered in the Users functionality due to improper validation of an input parameter.Check if you run itEPSS 0.19%May 19, 2026