Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header.Check if you run itEPSS 0.46%Apr 15, 2026
- High7.5An issue in the file handling logic of the component download.php of SAC-NFe v2.0.02 allows attackers to execute a directory traversal and read arbitrary files from the system viaCheck if you run itEPSS 0.75%Apr 15, 2026
- High8.6Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador_ver.php endpoint.Check if you run itEPSS 0.23%Apr 15, 2026
- High7.5Incorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access sensitive information, including active session credentialsCheck if you run itEPSS 0.26%Apr 15, 2026
- Critical9.8Upsonic 0.71.6 contains a remote code execution vulnerability in its MCP server/task creation functionality.Check if you run itEPSS 1.01%Apr 15, 2026
- High8.6Agent Zero 0.9.8 contains a remote code execution vulnerability in its External MCP Servers configuration feature.Check if you run itEPSS 0.42%Apr 15, 2026
- High8.6LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execution handling.Check if you run itEPSS 0.49%Apr 15, 2026
- High7.3Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling.Check if you run itEPSS 0.36%Apr 15, 2026
- High8.0A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system.Check if you run itEPSS 0.29%Apr 15, 2026
- High8.3Daylight Studio FuelCMS v1.5.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the /controllers/Installer.php and the function add_git_submCheck if you run itEPSS 0.55%Apr 15, 2026
- High7.5CentSDR commit e40795 was discovered to contain a stack overflow in the "Thread1" function.Check if you run itEPSS 0.32%Apr 15, 2026
- High8.4Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code execution via injection oCheck if you run itEPSS 0.58%Apr 15, 2026
- Medium5.1immich is a high performance self-hosted photo and video management solution.Check if you run itEPSS 0.21%Apr 14, 2026
- High7.1Zarf is an Airgap Native Packager Manager for Kubernetes.Check if you run itEPSS 0.33%Apr 14, 2026
- High7.2Serendipity is a PHP-powered weblog engine.Check if you run itEPSS 0.26%Apr 14, 2026
- Medium4.4The List View Google Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event description in all versions up to, and including, 7.4.3 due to insuffiCheck if you run itEPSS 0.23%Apr 14, 2026
- Medium5.3The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on tCheck if you run itEPSS 0.89%Apr 14, 2026
- Medium6.5The Eleganzo theme for WordPress is vulnerable to arbitrary directory deletion due to insufficient path validation in the akd_required_plugin_callback function in all versions up tCheck if you run itEPSS 0.36%Apr 14, 2026
- High8.3mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management.Check if you run itEPSS 0.26%Apr 14, 2026
- Critical10.0OpenRemote is an open-source IoT platform.Check if you run itEPSS 0.94%Apr 14, 2026
- Critical9.6NuGet Gallery is a package repository that powers nuget.org.Check if you run itEPSS 0.54%Apr 14, 2026
- High7.2BoidCMS is an open-source, PHP-based flat-file CMS for building simple websites and blogs, using JSON as its database.Check if you run itEPSS 0.74%Apr 14, 2026
- Critical9.3Jellyfin is an open source self hosted media server.Check if you run itEPSS 0.32%Apr 14, 2026
- Low3.5OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers.Check if you run itEPSS 0.19%Apr 14, 2026
- High7.8Adobe Framemaker versions 2022.8 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code execution in the context ofCheck if you run itEPSS 0.18%Apr 14, 2026
Sort