Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.0Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()Check if you run itEPSS 0.21%Apr 9, 2026
- High8.2OPNsense is a FreeBSD based firewall and routing platform.Check if you run itEPSS 0.42%Apr 9, 2026
- High7.0Axios is a promise based HTTP client for the browser and Node.js.Check if you run itEPSS 1.21%Apr 9, 2026
- High7.5A security flaw has been discovered in GL.iNet GL-RM1, GL-RM10, GL-RM10RC and GL-RM1PE 1.8.1.Check if you run itEPSS 0.52%Apr 9, 2026
- High7.2Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.Check if you run itEPSS 0.43%Apr 9, 2026
- High7.2An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.Check if you run itEPSS 0.37%Apr 9, 2026
- High7.5HashiCorp’s go-getter library up to v1.8.5 may allow arbitrary file reads on the file system during certain git operations through a maliciously crafted URL.Check if you run itEPSS 0.59%Apr 9, 2026
- High7.5Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityPatch nowKEVEPSS 98.50%Apr 9, 2026
- Medium5.3The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions up to, and includingCheck if you run itEPSS 0.47%Apr 9, 2026
- Medium6.4The List category posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'catlist' shortcode in all versions up to, and including, 0.94.0 due to iCheck if you run itEPSS 0.28%Apr 9, 2026
- Critical9.1When user logged out, the JWT token the user had authtenticated with was not invalidated, which could lead to reuse of that token in case it was intercepted.Check if you run itEPSS 0.68%Apr 9, 2026
- UnknownCGA-3h38-g9qp-52x5Open the advisoryApr 9, 2026
- High7.2An authenticated remote attacker with high privileges can exploit the OpenVPN configuration via the web-based management interface of a WAGO PLC.Check if you run itEPSS 0.74%Apr 9, 2026
- Medium6.5Mattermost Plugins versions <=2.1.3.0 fail to limit the request body size on the {{/changes}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion andCheck if you run itEPSS 0.32%Apr 9, 2026
- Medium6.5Mattermost Plugins versions <=2.3.1 fail to limit the request body size on the {{/lifecycle}} webhook endpoint which allows an authenticated attacker to cause memory exhaustion andCheck if you run itEPSS 0.32%Apr 9, 2026
- UnknownCGA-c8mh-7wjv-rj77Open the advisoryApr 9, 2026
- High8.7AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters.Check if you run itEPSS 0.29%Apr 9, 2026
- High8.8AlanWeb SCADA does not enforce authorization for some directories.Check if you run itEPSS 0.30%Apr 9, 2026
- Medium6.9AlanWeb SCADA saves sensitive information into a log file.Check if you run itEPSS 0.27%Apr 9, 2026
- High7.5An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.Check if you run itEPSS 0.54%Apr 9, 2026
- Critical9.1In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certifCheck if you run itEPSS 0.28%Apr 9, 2026
- Critical9.1In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/contaiCheck if you run itEPSS 0.43%Apr 9, 2026
- Critical9.1Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and raw.qemu.conCheck if you run itEPSS 0.37%Apr 9, 2026
- Medium6.5Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavCheck if you run itEPSS 0.70%Apr 9, 2026
- Critical9.3A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024.Check this weekEPSS 16.89%Apr 9, 2026
Sort