Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.1mindsdb mindsdb Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 20.26%Jan 12, 2026
- High8.2Errands before 46.2.10 does not verify TLS certificates for CalDAV servers.Check if you run itEPSS 0.16%Jan 12, 2026
- High8.7Weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, use user creation, modiCheck if you run itEPSS 0.24%Jan 12, 2026
- High8.6IDOR vulnerability has been found in Viafirma Inbox v4.5.13 that allows any authenticated user without privileges in the application to list all users, access and modify their dataCheck if you run itEPSS 0.24%Jan 12, 2026
- Critical9.3Imaster's MEMS Events CRM contains an SQL injection vulnerability in ‘phone’ parameter in ‘/memsdemo/login.php’.Check if you run itEPSS 0.33%Jan 12, 2026
- High8.7Imaster's MEMS Events CRM contains an SQL injection vulnerability in‘keyword’ parameter in ‘/memsdemo/exchange_offers.php’.Check if you run itEPSS 0.30%Jan 12, 2026
- High8.7Imaster's Patient Records Management System is vulnerable to SQL Injection in the endpoint ‘/projects/hospital/admin/complaints.php’ through the ‘id’ parameter.Check if you run itEPSS 0.30%Jan 12, 2026
- Medium5.1Imaster's Patient Record Management System contains a stored Cross-Site Scripting (XSS) vulnerability in the endpoint ‘/projects/hospital/admin/edit_patient.php’.Check if you run itEPSS 0.27%Jan 12, 2026
- Medium5.1Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST requestCheck if you run itEPSS 0.27%Jan 12, 2026
- Medium5.1Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a lack of proper validation of user input by sending a POST request to ‘/store-ticket’,Check if you run itEPSS 0.27%Jan 12, 2026
- Medium5.1Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's TicketGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/ticketgo-saas/home’, usCheck if you run itEPSS 0.27%Jan 12, 2026
- Medium5.1Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's HRMGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/hrmgo/ticket/changereply’,Check if you run itEPSS 0.27%Jan 12, 2026
- High8.1MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server.Check if you run itEPSS 0.22%Jan 12, 2026
- High8.7Certain IP Camera models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute themCheck if you run itEPSS 1.18%Jan 12, 2026
- Medium4.8The Quiz Maker WordPress plugin before 6.7.0.89 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-SiteCheck if you run itEPSS 0.21%Jan 12, 2026
- High8.7Certain DVR/NVR models developed by Merit LILIN has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them oCheck if you run itEPSS 1.15%Jan 12, 2026
- Low2.3Deserialization of Untrusted Data vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Object Injection.This issue affects DX NetOps Spectrum: 24.3.13 and earlier.Check if you run itEPSS 0.31%Jan 12, 2026
- High7.1Dependency on Vulnerable Third-Party Component vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows DOM-Based XSS.This issue affects DX NetOps Spectrum: 24.3.9 andCheck if you run itEPSS 0.15%Jan 12, 2026
- Low2.3Authorization Bypass Through User-Controlled Key vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Privilege Escalation.This issue affects DX NetOps Spectrum: 2Check if you run itEPSS 0.28%Jan 12, 2026
- High8.7Improper Authentication vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Authentication Bypass.This issue affects DX NetOps Spectrum: 24.3.10 and earlier.Check if you run itEPSS 0.35%Jan 12, 2026
- Medium5.3Cleartext Transmission of Sensitive Information vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Sniffing Attacks.This issue affects DX NetOps Spectrum: 21.2.1Check if you run itEPSS 0.17%Jan 12, 2026
- Low2.3Insufficiently Protected Credentials vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Sniffing Attacks.This issue affects DX NetOps Spectrum: 24.3.13 and earliCheck if you run itEPSS 0.24%Jan 12, 2026
- Low2.3Information Exposure Through Query Strings in GET Request vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Session Hijacking.This issue affects DX NetOps SpectCheck if you run itEPSS 0.33%Jan 12, 2026
- High7.1Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows OS Command InjectioCheck if you run itEPSS 0.89%Jan 12, 2026
- Medium5.3Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Reflected XSS.ThisCheck if you run itEPSS 0.17%Jan 12, 2026
Sort