Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.1SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user profile update workflow (user_settings.php submitting to admin/update_user.php).Check if you run itEPSS 0.20%Feb 20, 2026
- Medium6.8Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.Check if you run itEPSS 0.10%Feb 20, 2026
- High8.4Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.Check if you run itEPSS 0.13%Feb 20, 2026
- High8.4Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.Check if you run itEPSS 0.13%Feb 20, 2026
- High8.4Uncontrolled Search Path Element in Owl opds 2.2.0.4 allows Leveraging/Manipulating Configuration File Search Paths via a crafted network request.Check if you run itEPSS 0.13%Feb 20, 2026
- High8.5Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.Check if you run itEPSS 0.11%Feb 20, 2026
- High8.5Incorrect Permission Assignment for Critical Resource in Owl opds 2.2.0.4 allows File Manipulation via a crafted network request.Check if you run itEPSS 0.11%Feb 20, 2026
- High8.7Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request.Check if you run itEPSS 1.28%Feb 20, 2026
- Medium5.1SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user registration workflow (index.php submitting to admin/user_action.php).Check if you run itEPSS 0.22%Feb 20, 2026
- Medium5.1SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in radiomobile_front.php via the stationid query parameter.Check if you run itEPSS 0.22%Feb 20, 2026
- Medium5.1SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in admin/log.php via the search query parameter.Check if you run itEPSS 0.19%Feb 20, 2026
- Critical9.2Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opds 2.2.0.4 allows Command Injection via a crafted network request.Check if you run itEPSS 1.19%Feb 20, 2026
- Medium5.1SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter.Check if you run itEPSS 0.24%Feb 20, 2026
- Medium6.2HyperCloud versions 2.3.5 through 2.6.8 improperly allowed refresh tokens to be used directly for resource access and failed to invalidate previously issued access tokens when a reCheck if you run itEPSS 0.24%Feb 20, 2026
- High7.3A vulnerability was detected in UTT HiPER 520 1.7.7-160105.Check this weekEPSS 10.46%Feb 20, 2026
- High7.3A security vulnerability has been detected in UTT HiPER 520 1.7.7-160105.Check this weekEPSS 11.02%Feb 20, 2026
- Critical9.8A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface.Check if you run itEPSS 1.04%Feb 20, 2026
- Medium6.1A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser.Check if you run itEPSS 0.32%Feb 20, 2026
- High8.2The underlying PLC of the device can be remotely influenced, without proper safeguards or authentication.Check if you run itEPSS 0.51%Feb 20, 2026
- High7.5The Wi-Fi router is vulnerable to de-authentication attacks due to the absence of management frame protection, allowing forged deauthentication and disassociation frames to be broaCheck if you run itEPSS 0.28%Feb 20, 2026
- Medium5.7The web management interface of the device renders the passwords in a plaintext input field.Check if you run itEPSS 0.34%Feb 20, 2026
- High8.2A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory.Check if you run itEPSS 0.33%Feb 20, 2026
- High7.5The embedded web interface of the device does not support HTTPS/TLS for authentication and uses HTTP Basic Authentication.Check if you run itEPSS 0.27%Feb 20, 2026
- Critical9.8The web management interface of the device allows the administrator username and password to be set to blank values.Check if you run itEPSS 0.64%Feb 20, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager pixelyoursite allCheck if you run itEPSS 0.17%Feb 20, 2026
Sort