Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.5FreeLAN 2.2 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code.Check if you run itEPSS 0.16%Jan 21, 2026
- Medium5.1VestaCP versions prior to 0.9.8-25 contain a cross-site scripting vulnerability in the IP interface configuration that allows attackers to inject malicious scripts.Check if you run itEPSS 0.23%Jan 21, 2026
- High7.0SEO Panel versions prior to 4.9.0 contain a blind SQL injection vulnerability in the archive.php page that allows authenticated attackers to manipulate database queries through theCheck if you run itEPSS 0.27%Jan 21, 2026
- High8.6Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary locations using the API index.php endpointCheck if you run itEPSS 0.50%Jan 21, 2026
- High8.5WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the WPCommandFileService that allows local users to potentially execute code with elevated privileges.Check if you run itEPSS 0.15%Jan 21, 2026
- High8.5WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the GuardTourService that allows local users to potentially execute code with elevated system privileges.Check if you run itEPSS 0.15%Jan 21, 2026
- High8.7ProFTPD 1.3.7a contains a denial of service vulnerability that allows attackers to overwhelm the server by creating multiple simultaneous FTP connections.Check if you run itEPSS 0.60%Jan 21, 2026
- High8.5OSAS Traverse Extension 11 contains an unquoted service path vulnerability in the TravExtensionHostSvc service running with LocalSystem privileges.Check if you run itEPSS 0.15%Jan 21, 2026
- High8.5MacPaw Encrypto 1.0.1 contains an unquoted service path vulnerability in its Encrypto Service configuration that allows local attackers to potentially execute arbitrary code.Check if you run itEPSS 0.15%Jan 21, 2026
- High8.5Event Log Explorer 4.9.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges.Check if you run itEPSS 0.15%Jan 21, 2026
- High8.5ActivIdentity 8.2 contains an unquoted service path vulnerability in the ac.sharedstore service that allows local attackers to potentially execute arbitrary code.Check if you run itEPSS 0.15%Jan 21, 2026
- Medium5.1Genexis Platinum-4410 P4410-V2-1.31A contains a stored cross-site scripting vulnerability in the 'start_addr' parameter of the Security Management interface.Check if you run itEPSS 0.28%Jan 21, 2026
- Medium5.1Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts.Check if you run itEPSS 0.38%Jan 21, 2026
- Medium5.1Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scripts.Check if you run itEPSS 0.28%Jan 21, 2026
- High8.7DD-WRT version 45723 contains a buffer overflow vulnerability in the UPNP network discovery service that allows remote attackers to potentially execute arbitrary code.Check if you run itEPSS 1.08%Jan 21, 2026
- High8.8Blitar Tourism 1.0 contains an authentication bypass vulnerability that allows attackers to bypass login by injecting SQL code through the username parameter.Check if you run itEPSS 0.39%Jan 21, 2026
- High8.8Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers to bypass authenticaCheck if you run itEPSS 0.43%Jan 21, 2026
- Medium5.1GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability.Check if you run itEPSS 0.40%Jan 21, 2026
- Medium4.8OpenEMR 5.0.2.1 contains a cross-site scripting vulnerability in user profile parameters that authenticated attackers can chain with a file upload to achieve remote code execution.Check if you run itEPSS 0.81%Jan 21, 2026
- High8.7Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files.Check if you run itEPSS 0.70%Jan 21, 2026
- High8.6OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to inject malicious code through the hardware configuration inCheck if you run itEPSS 0.75%Jan 21, 2026
- Critical9.3Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation.Check if you run itEPSS 1.13%Jan 21, 2026
- High8.6NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through the emoji upload API.Check if you run itEPSS 0.74%Jan 21, 2026
- High7.2Logic vulnerability in TP-Link Archer C20 v5, 6.0, Archer AX53 v1.0 and TL-WR841N v13 (TDDP module) allows unauthenticated adjacent attackers to execute administrative commands incCheck if you run itEPSS 0.43%Jan 21, 2026
- Medium4.8Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise (Packaged CCE) and Cisco Unified Contact Center Enterprise (Unified CCE)Check if you run itEPSS 0.21%Jan 21, 2026
Sort