Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.4An SQL Injection vulnerability exists in the GetServiceByRestaurantID endpoint of the Aptsys gemscms POS Platform backend thru 2025-05-28.Check if you run itEPSS 0.36%Jan 23, 2026
- Critical9.4A vulnerability exists in the Aptsys POS Platform Web Services module thru 2025-05-28, which exposes internal API testing tools to unauthenticated users.Check if you run itEPSS 0.45%Jan 23, 2026
- Medium5.3A vulnerability in the PHP backend of gemscms.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal file pCheck if you run itEPSS 0.45%Jan 23, 2026
- Medium5.3A vulnerability in the PHP backend of gemsloyalty.aptsys.com.sg thru 2025-05-28 allows unauthenticated remote attackers to trigger detailed error messages that disclose internal fiCheck if you run itEPSS 0.45%Jan 23, 2026
- UnknownWPS Hide Login Plugin for WordPress Login Page DisclosurePatch nowKEVEPSS 1.23%Jan 23, 2026
- Medium6.0An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random values.Check if you run itEPSS 0.22%Jan 22, 2026
- High7.4Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network.Check if you run itEPSS 0.61%Jan 22, 2026
- Critical9.3Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing over a network.Check if you run itEPSS 0.41%Jan 22, 2026
- High8.2Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.Check if you run itEPSS 0.57%Jan 22, 2026
- Critical9.3Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.Check if you run itEPSS 0.91%Jan 22, 2026
- Critical9.3Azure Entra ID Elevation of Privilege VulnerabilityCheck if you run itEPSS 0.54%Jan 22, 2026
- High7.4Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network.Check if you run itEPSS 0.61%Jan 22, 2026
- Critical9.8Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.Check if you run itEPSS 0.85%Jan 22, 2026
- High7.5Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vectorCheck if you run itEPSS 1.53%Jan 22, 2026
- High8.9Dragonfly is an open source P2P-based file distribution and image acceleration system.Check if you run itEPSS 0.78%Jan 22, 2026
- Critical9.1Gitea does not properly validate repository ownership when linking attachments to releases.Check if you run itEPSS 0.46%Jan 22, 2026
- Critical9.1Gitea does not properly validate repository ownership when deleting Git LFS locks.Check if you run itEPSS 0.46%Jan 22, 2026
- Critical9.1Gitea does not properly validate project ownership in organization project operations.Check if you run itEPSS 0.43%Jan 22, 2026
- High7.5Gitea does not properly verify repository context when deleting attachments.Check if you run itEPSS 0.43%Jan 22, 2026
- Critical9.4An Authorization Bypass Through User-Controlled Key vulnerability in Hubitat Elevation home automation controllers prior to version 2.4.2.157 could allow a remote authenticated useCheck if you run itEPSS 0.47%Jan 22, 2026
- Critical9.8Langflow Inclusion of Functionality from Untrusted Control Sphere VulnerabilityPatch nowKEVEPSS 62.56%Jan 22, 2026
- High8.5Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.Check if you run itEPSS 0.17%Jan 22, 2026
- High8.1A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk FusionCheck if you run itEPSS 0.66%Jan 22, 2026
- High8.1A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktopCheck if you run itEPSS 0.53%Jan 22, 2026
- High8.1A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulCheck if you run itEPSS 0.68%Jan 22, 2026
Sort