Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.0Ivanti Connect Secure and Policy Secure Inclusion of Functionality from Untrusted Control SpherePatch nowKEVEPSS 0.25%Oct 15, 2026
- Medium5.4Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' ParameterCheck if you run itEPSS 0.22%Oct 15, 2026
- Medium6.4GeoDirectory <= 2.8.191 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via data-embed-url AttributeCheck if you run itEPSS 0.22%Oct 15, 2026
- High7.2GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log BodyCheck if you run itEPSS 0.19%Oct 15, 2026
- UnknownMalicious code in proxyrobika (PyPI)Open the advisoryOct 15, 2026
- Medium5.3ZoneMinder is a free, open source closed-circuit television software application.Check if you run itEPSS 0.39%Oct 15, 2026
- High8.8DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment EndpointCheck if you run itEPSS 0.52%Oct 15, 2026
- High7.2SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in CommentCheck if you run itEPSS 0.28%Oct 15, 2026
- Medium6.4Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode AttributeCheck if you run itEPSS 0.19%Oct 15, 2026
- Medium5.4The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5.Check if you run itEPSS 0.23%Oct 15, 2026
- High7.5Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' ParameterCheck if you run itEPSS 0.33%Oct 15, 2026
- Medium6.4Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name ParameterCheck if you run itEPSS 0.20%Oct 15, 2026
- Medium6.4Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network SettingCheck if you run itEPSS 0.20%Oct 15, 2026
- High7.2User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer HeaderCheck if you run itEPSS 0.19%Oct 15, 2026
- Medium5.4Scoold is a Q&A and a knowledge sharing platform for teams.Check if you run itEPSS 0.11%Oct 15, 2026
- Medium5.4Scoold is a Q&A and a knowledge sharing platform for teams.Check if you run itEPSS 0.26%Oct 15, 2026
- High8.1AliasVault is a privacy-first password manager with built-in email aliasing.Check if you run itEPSS 0.15%Oct 15, 2026
- Critical9.1Tianji is an open source analytics, uptime monitoring, and server status platform.Check if you run itEPSS 0.58%Oct 15, 2026
- High8.8Tianji is an open source analytics, uptime monitoring, and server status platform.Check if you run itEPSS 0.34%Oct 15, 2026
- Critical9.3runwasi facilitates running Wasm and WASI workloads managed by containerd.Check if you run itEPSS 0.39%Oct 15, 2026
- High8.6An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch.Check if you run itEPSS 0.21%Oct 15, 2026
- Medium6.5A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon.Check if you run itEPSS 0.25%Oct 15, 2026
- Critical9.1An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon.Check if you run itEPSS 0.38%Oct 15, 2026
- High8.2SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or auto…Check if you run itEPSS 0.31%Oct 15, 2026
- Low2.3Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via…Check if you run itEPSS 0.48%Oct 15, 2026