Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Unknownhongdian h8922 Direct Request ('Forced Browsing')Patch nowKEVEPSS 2.79%Aug 23, 2025
- Medium5.3The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration.Check if you run itEPSS 0.39%Aug 22, 2025
- Medium5.3Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin:Check if you run itEPSS 0.22%Aug 22, 2025
- Medium5.9The WP Crontrol plugin for WordPress is vulnerable to blind Server-Side Request Forgery in versions 1.17.0 to 1.19.1 via the 'wp_remote_request' function.Check if you run itEPSS 0.36%Aug 22, 2025
- High7.1The WP Talroo WordPress plugin through 2.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could bCheck if you run itEPSS 0.25%Aug 22, 2025
- Critical9.8Authentication Bypass Using an Alternate Path or ChannelPatch nowKEVEPSS 0.74%Aug 22, 2025
- Medium5.3An Insecure Direct Object Reference (IDOR) vulnerability in Reolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 allows unauthorized attackerCheck if you run itEPSS 0.24%Aug 22, 2025
- Critical9.8Voltronic Power ViewPower through 1.04-21353 and PowerShield Netguard before 1.04-23292 allows a remote attacker to configure the system via an unspecified web interface.Check if you run itEPSS 0.66%Aug 22, 2025
- High8.0UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework.Check if you run itEPSS 0.39%Aug 21, 2025
- High8.1The Inspiro theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2.Check if you run itEPSS 0.23%Aug 21, 2025
- Critical9.8Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding the sign-up option on the login page UICheck if you run itEPSS 0.57%Aug 21, 2025
- High8.8hippo4j 1.0.0 to 1.5.0, uses a hard-coded secret key in its JWT (JSON Web Token) creation.Check if you run itEPSS 0.35%Aug 21, 2025
- Medium5.3A security flaw has been discovered in elunez eladmin up to 2.7.Check if you run itEPSS 0.34%Aug 20, 2025
- Medium6.3A vulnerability was identified in elunez eladmin up to 2.7.Check if you run itEPSS 0.20%Aug 20, 2025
- High7.3AOMEI Backupper Workstation Link Following Local Privilege Escalation Vulnerability.Check if you run itEPSS 0.20%Aug 20, 2025
- High7.1Insufficient CSRF protection for omni-administrator users in Liferay Portal 7.0.0 through 7.4.3.119, and Liferay DXP 2024.Q1.1 through 2024.Q1.6, 2023.Q4.0 through 2023.Q4.9, 2023.Check if you run itEPSS 0.17%Aug 20, 2025
- High7.2CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an authenticated attacker wiCheck if you run itEPSS 0.91%Aug 20, 2025
- Medium5.1QuickCMS is vulnerable to Cross-Site Request Forgery in article creation functionality.Check if you run itEPSS 0.13%Aug 20, 2025
- Medium4.8QuickCMS is vulnerable to Stored XSS in sTitle parameter in page editor functionality.Check if you run itEPSS 0.19%Aug 20, 2025
- Medium5.1A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.3, 2024.Q4.0 through 2024.Q4.7, 2024.QCheck if you run itEPSS 0.22%Aug 20, 2025
- Medium5.4The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0.Check if you run itEPSS 0.17%Aug 20, 2025
- Medium4.3MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes which are intended onlyCheck if you run itEPSS 0.21%Aug 20, 2025
- Medium5.3During the brief window between installation and the first administrator login, remote attackers may exploit the default credential to gain admin control.Check if you run itEPSS 1.23%Aug 20, 2025
- High8.8XWiki through version 17.3.0 is vulnerable to Server-Side Template Injection (SSTI) in the Administration interface, specifically within the HTTP Meta Info field of the Global PrefCheck if you run itEPSS 3.69%Aug 20, 2025
- Medium4.8XWiki through version 17.3.0 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities in the Administration interface, specifically under the Presentation sectionCheck if you run itEPSS 0.50%Aug 20, 2025
Sort