Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.Check if you run itEPSS 0.81%Oct 13, 2026
- Medium5.3Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety.ts, which fails to check N…Check if you run itEPSS 0.25%Oct 13, 2026
- Low2.7Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbCheck if you run itEPSS 0.30%Oct 13, 2026
- Low2.3Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blocklist through DNS rebinding or…Check if you run itEPSS 0.28%Oct 13, 2026
- Medium6.9Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC c…Check if you run itEPSS 0.32%Oct 13, 2026
- High7.1Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI p…Check if you run itEPSS 0.39%Oct 13, 2026
- High8.7Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration…Check if you run itEPSS 0.45%Oct 13, 2026
- Critical10.0Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-asset extension such as .js…Check if you run itEPSS 0.56%Oct 13, 2026
- Critical9.1The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings_…Check if you run itEPSS 0.53%Oct 13, 2026
- High8.1The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the cl…Check if you run itEPSS 0.85%Oct 13, 2026
- High7.5The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege Escalation via Log Re-execu…Check if you run itEPSS 0.54%Oct 13, 2026
- Critical9.4Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass VulnerabilityCheck if you run itEPSS 0.79%Oct 13, 2026
- High8.7Qwik is a performance-focused JavaScript framework.Check if you run itEPSS 0.52%Oct 13, 2026
- High7.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.54%Oct 13, 2026
- Medium5.7Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over an adjacent network.Check if you run itEPSS 0.37%Oct 13, 2026
- High7.2An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.…Check if you run itEPSS 0.31%Oct 13, 2026
- Medium6.5An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.…Check if you run itEPSS 0.25%Oct 13, 2026
- High7.2An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.…Check if you run itEPSS 0.31%Oct 13, 2026
- High8.8An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.…Check if you run itEPSS 0.32%Oct 13, 2026
- Medium6.3The AVDTP signalling layer arms a 6-second command timeout (AVDTP_TIMEOUT) in avdtp_send_cmd() whenever the local device issues an AVDTP request.Check if you run itEPSS 0.18%Oct 13, 2026
- Medium6.9ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers…Check if you run itEPSS 0.26%Oct 13, 2026
- High8.7Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows…Check if you run itEPSS 0.43%Oct 13, 2026
- Medium6.9FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by callin…Check if you run itEPSS 0.41%Oct 13, 2026
- High7.7Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and sk…Check if you run itEPSS 0.12%Oct 13, 2026
- Medium5.3Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by…Check if you run itEPSS 0.24%Oct 13, 2026