Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.5A flaw was found in KubeVirt Containerized Data Importer (CDI).Check if you run itEPSS 0.37%Jan 26, 2026
- Medium5.3A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode.Check if you run itEPSS 0.52%Jan 26, 2026
- High7.5Denial of Service Vulnerabilities in React Server ComponentsCheck if you run itEPSS 2.58%Jan 26, 2026
- High8.5Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute system commands with a lCheck if you run itEPSS 2.77%Jan 26, 2026
- High7.1Crucial Storage Executive installer versions prior to 11.08.082025.00 contain a DLL preloading vulnerability.Check if you run itEPSS 0.21%Jan 26, 2026
- High7.1Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) implement an insecure Cross-Origin Resource Sharing (CORS) policy on authenticated administrative endCheck if you run itEPSS 0.25%Jan 26, 2026
- Low2.1Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) fail to include the X-Content-Type-Options: nosniff response header on web management interfaces.Check if you run itEPSS 0.20%Jan 26, 2026
- Medium5.1Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) lack cross-site request forgery (CSRF) protections on administrative endpoints, including those usedCheck if you run itEPSS 0.13%Jan 26, 2026
- Medium5.1Forma LMS 2.3 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious scripts into user profile first and last name fields.Check if you run itEPSS 0.23%Jan 26, 2026
- High8.5IDT PC Audio 1.0.6499.0 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges.Check if you run itEPSS 0.15%Jan 26, 2026
- High8.5Kite 1.2020.1119.0 contains an unquoted service path vulnerability in the KiteService Windows service that allows local attackers to potentially execute arbitrary code.Check if you run itEPSS 0.15%Jan 26, 2026
- High8.5PDF Complete 3.5.310.2002 contains an unquoted service path vulnerability in its pdfsvc.exe service configuration.Check if you run itEPSS 0.15%Jan 26, 2026
- Medium5.1Openfire 4.6.0 contains a stored cross-site scripting vulnerability in the nodejs plugin that allows attackers to inject malicious scripts through the 'path' parameter.Check if you run itEPSS 0.28%Jan 26, 2026
- Medium5.1Grav CMS 1.6.30 with Admin Plugin 1.9.18 contains a persistent cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the page tCheck if you run itEPSS 0.63%Jan 26, 2026
- Medium5.1Xeroneit Library Management System 3.1 contains a stored cross-site scripting vulnerability in the Book Category feature that allows administrators to inject malicious scripts.Check if you run itEPSS 0.34%Jan 26, 2026
- High8.5MiniTool ShadowMaker 3.2 contains an unquoted service path vulnerability in the MTAgentService that allows local attackers to potentially execute arbitrary code.Check if you run itEPSS 0.19%Jan 26, 2026
- Medium5.1Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain a stored cross-site scripting vulnerability in the user creation functionality.Check if you run itEPSS 0.21%Jan 26, 2026
- High7.1Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) display stored user account passwords in plaintext within the administrative web interface.Check if you run itEPSS 0.21%Jan 26, 2026
- Medium4.8Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) serve sensitive administrative content without appropriate cache-control directives.Check if you run itEPSS 0.17%Jan 26, 2026
- Critical9.2Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpoints.Check if you run itEPSS 0.46%Jan 26, 2026
- High8.7Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated uCheck if you run itEPSS 0.34%Jan 26, 2026
- High8.2Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenancCheck if you run itEPSS 0.27%Jan 26, 2026
- Critical9.3Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account that is not required toCheck if you run itEPSS 0.43%Jan 26, 2026
- High8.7Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed through the maintenance interface without requiring verificatioCheck if you run itEPSS 0.31%Jan 26, 2026
- Medium5.0There is a Cross‑Site Scripting (XSS) issue in Esri ArcGIS Pro versions 3.6.0 and earlier.Check if you run itEPSS 0.17%Jan 26, 2026
Sort