Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an authenticated APCheck if you run itEPSS 0.23%Apr 1, 2026
- High8.2Improper authentication in the two-factor authentication (2FA) feature in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multifaCheck if you run itEPSS 0.33%Apr 1, 2026
- High8.2Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multi-factor authentiCheck if you run itEPSS 0.26%Apr 1, 2026
- Medium5.4Improper authentication in the external OAuth authentication flow in Devolutions Server 2026.1.11 and earlier allows an authenticated user to authenticate as other users, includingCheck if you run itEPSS 0.17%Apr 1, 2026
- Medium6.4The King Addons for Elementor plugin for WordPress is vulnerable to multiple Contributor+ DOM-Based Stored Cross-Site Scripting vulnerabilities in all versions up to, and includingCheck if you run itEPSS 0.25%Apr 1, 2026
- Medium5.5A flaw was found in libinput.Check if you run itEPSS 0.15%Apr 1, 2026
- Medium6.5A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation.Check if you run itEPSS 0.27%Apr 1, 2026
- High8.4An arbitrary file overwrite vulnerability in Tinybeans Private Family Album App v5.9.5-prod allows attackers to overwrite critical internal files via the file import p…Check if you run itEPSS 0.21%Apr 1, 2026
- High7.4A local file inclusion vulnerability in the upload/download flow of the VertiGIS FM application allows authenticated attackers to read arbitrary files from the server…Check if you run itEPSS 0.62%Apr 1, 2026
- High8.8A flaw was found in libinput.Check if you run itEPSS 0.18%Apr 1, 2026
- Medium5.6pymanager included the current working directory in sys.path meaning modules could be shadowed by modules in the current working directory.Check if you run itEPSS 0.18%Apr 1, 2026
- High8.6ByteDance DeerFlow versions prior to commit 92c7a20 contain a sandbox escape vulnerability in bash tool handling that allows attackers to execute arbitrary commands on the host sysCheck if you run itEPSS 0.41%Apr 1, 2026
- Medium6.9OpenViking versions 0.2.5 prior to 0.2.14 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthenticated attackers to access protected boCheck if you run itEPSS 0.43%Apr 1, 2026
- High7.5A flaw was found in Corosync.Check if you run itEPSS 1.01%Apr 1, 2026
- High8.2A flaw was found in Corosync.Check if you run itEPSS 0.88%Apr 1, 2026
- High7.3A reflected cross-site scripting (XSS) vulnerability in the dashboard search functionality of the VertiGIS FM solution allows attackers to craft a malicious URL, that if visited byCheck if you run itEPSS 0.19%Apr 1, 2026
- Critical9.3metinfo metinfo Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 39.49%Apr 1, 2026
- High7.3Dell AppSync, version(s) 4.6.0, contain(s) an Incorrect Permission Assignment for Critical Resource vulnerability.Check if you run itEPSS 0.13%Apr 1, 2026
- High7.3Dell AppSync, version(s) 4.6.0, contain(s) an UNIX Symbolic Link (Symlink) Following vulnerability.Check if you run itEPSS 0.17%Apr 1, 2026
- Medium6.7A vulnerability was identified in MEPIS RM, an industrial software product developed by Metronik.Check if you run itEPSS 0.16%Apr 1, 2026
- Medium5.3Insufficient permission validation on multiple REST API Quick Setup endpoints in Checkmk 2.5.0 (beta) before version 2.5.0b2 and 2.4.0 before version 2.4.0p25 allows low-privilegedCheck if you run itEPSS 0.24%Apr 1, 2026
- Medium6.9Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenticated attackeCheck if you run itEPSS 0.20%Apr 1, 2026
- Medium5.3A vulnerability was detected in Harvard University IQSS Dataverse up to 6.8.Check if you run itEPSS 0.26%Apr 1, 2026
- Medium5.3Ericsson Packet Core Controller (PCC) versions prior to 1.38 contain a vulnerability where an attacker sending a large volume of specially crafted messages may cause service degradCheck if you run itEPSS 0.38%Apr 1, 2026
- Medium6.9Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.Check if you run itEPSS 0.35%Apr 1, 2026
Sort