Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.2Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kubernetes distribution.Check if you run itEPSS 0.33%Feb 12, 2026
- High7.1thesystem App 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the username parameter.Check if you run itEPSS 0.52%Feb 12, 2026
- High7.1TheSystem 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating the 'server_name' parameter.Check if you run itEPSS 0.52%Feb 12, 2026
- High8.5Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code.Check if you run itEPSS 0.15%Feb 12, 2026
- High8.5Wondershare MobileGo 8.5.0 contains an insecure file permissions vulnerability that allows local users to modify executable files in the application directory.Check if you run itEPSS 0.19%Feb 12, 2026
- High8.5NextVPN 4.10 contains an insecure file permissions vulnerability that allows local users to modify executable files with full access rights.Check if you run itEPSS 0.13%Feb 12, 2026
- Medium4.9mreporting is the more reporting GLPI plugin.Check if you run itEPSS 0.29%Feb 12, 2026
- Critical9.3newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm.Check if you run itEPSS 0.23%Feb 12, 2026
- Critical9.3newbee-mall includes pre-seeded administrator accounts in its database initialization script.Check if you run itEPSS 0.44%Feb 12, 2026
- Medium5.3webtransport-go is an implementation of the WebTransport protocol.Check if you run itEPSS 0.41%Feb 12, 2026
- Medium5.3webtransport-go is an implementation of the WebTransport protocol.Check if you run itEPSS 0.46%Feb 12, 2026
- Medium5.3webtransport-go is an implementation of the WebTransport protocol.Check if you run itEPSS 0.46%Feb 12, 2026
- High7.3A DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.Check if you run itEPSS 0.15%Feb 12, 2026
- High8.4Type confusion in the AMD Secure Processor (ASP) could allow an attacker to pass a malformed argument to the External Global Memory Interconnect Trusted Agent (XGMI TA) leading toCheck if you run itEPSS 0.16%Feb 12, 2026
- Medium6.3Debug code left active in AMD's Video Decoder Engine Firmware (VCN FW) could allow a attacker to submit a maliciously crafted command causing the VCN FW to perform read/writes HW rCheck if you run itEPSS 0.14%Feb 12, 2026
- Medium4.6Improper input validation within RAS TA Driver can allow a local attacker to access out-of-bounds memory, potentially resulting in a denial-of-service condition.Check if you run itEPSS 0.18%Feb 12, 2026
- High8.7Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromise data confidentiality or integrity.Check if you run itEPSS 0.32%Feb 12, 2026
- High8.6BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 use a default password that is guessable with knowledge of the device informationCheck if you run itEPSS 0.15%Feb 12, 2026
- Low2.0FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk.Check if you run itEPSS 0.35%Feb 12, 2026
- Critical9.2Crawl4AI versions prior to 0.8.0 contain a local file inclusion vulnerability in the Docker API deployment.Check if you run itEPSS 2.07%Feb 12, 2026
- Critical10.0kidocode crawl4ai Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 6.33%Feb 12, 2026
- Critical9.1Galaxy FDS Android SDK (XiaoMi/galaxy-fds-sdk-android) version 3.0.8 and prior disable TLS hostname verification when HTTPS is enabled (the default configuration).Check if you run itEPSS 0.20%Feb 12, 2026
- High8.8The FastDup – Fastest WordPress Migration & Duplicator plugin for WordPress is vulnerable to unauthorized backup creation and download due to a missing capability check on REST APICheck if you run itEPSS 0.32%Feb 12, 2026
- High7.2An unintended proxy or intermediary in the AMD power management firmware (PMFW) could allow a privileged attacker to send malformed messages to the system management unit (SMU) potCheck if you run itEPSS 0.12%Feb 12, 2026
- Critical9.8Unrestricted Upload of File with Dangerous Type vulnerability in NTN Information Processing Services Computer Software Hardware Industry and Trade Ltd.Check if you run itEPSS 0.43%Feb 12, 2026
Sort