Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3RiteCMS v3.1.0 was discovered to use insecure encryption to store passwords.Check if you run itEPSS 0.14%Dec 17, 2025
- Critical9.8An Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.Check if you run itEPSS 0.50%Dec 17, 2025
- Critical9.9An authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHPCheck if you run itEPSS 0.53%Dec 17, 2025
- Medium6.5A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code exeCheck if you run itEPSS 0.38%Dec 17, 2025
- Critical9.8A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service and possibly code exeCheck if you run itEPSS 0.69%Dec 17, 2025
- High8.8CSRF vulnerability in narda miteq Uplink Power Contril Unit UPC2 v.1.17 allows a remote attacker to execute arbitrary code via the Web-based management interface and specifically tCheck if you run itEPSS 0.30%Dec 17, 2025
- Medium6.1A Cross-site scripting (XSS) vulnerability in Create/Update Item Kit(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the "Check if you run itEPSS 0.26%Dec 17, 2025
- High7.2A Cross-site scripting (XSS) vulnerability in Create/Update Customer(s) in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via the pCheck if you run itEPSS 0.55%Dec 17, 2025
- High7.2A Cross-site scripting (XSS) vulnerability in Create/Update Item(s) Module in Open Source Point of Sale v3.4.1 allows remote attackers to inject arbitrary web script or HTML via thCheck if you run itEPSS 0.55%Dec 17, 2025
- Medium6.6The OTA firmware update mechanism in Netun Solutions HelpFlash IoT (firmware v18_178_221102_ASCII_PRO_1R5_50) uses hard-coded WiFi credentials identical across all devices and doesCheck if you run itEPSS 0.10%Dec 17, 2025
- Medium6.1Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysconfig.inc.php, which allows remote attackCheck if you run itEPSS 0.22%Dec 17, 2025
- High7.1KeePassXC-Browser thru 1.9.9.2 autofills or prompts to fill stored credentials into documents rendered under a browser-enforced CSP directive and iframe attribute sandbox, allowingCheck if you run itEPSS 0.14%Dec 17, 2025
- Low2.8There is a username enumeration via local user login in Entrinsik Informer v5.10.1 which allows malicious users to enumerate users by entering an OTP code and new password then revCheck if you run itEPSS 0.16%Dec 17, 2025
- High7.8An issue was discovered in the Portrait Dell Color Management application through 3.3.008 for Dell monitors, It creates a temporary folder, with weak permissions, during installatiCheck if you run itEPSS 0.11%Dec 17, 2025
- High7.8The Portrait Dell Color Management application 3.3.8 for Dell monitors has Insecure Permissions,Check if you run itEPSS 0.12%Dec 17, 2025
- Medium6.6SonicWall SMA1000 Missing Authorization VulnerabilityPatch nowKEVEPSS 2.76%Dec 17, 2025
- Critical10.0Cisco Multiple Products Improper Input Validation VulnerabilityPatch nowKEVEPSS 32.39%Dec 17, 2025
- High7.5ninjaforms ninja_forms Authorization Bypass Through User-Controlled KeyPatch nowKEVEPSS 0.44%Dec 17, 2025
- High7.8Miniconda3 macOS installers before 23.11.0-1 contain a local privilege escalation vulnerability when installed outside the user's home directory.Check if you run itEPSS 0.20%Dec 17, 2025
- High7.8Anaconda3 macOS installers before 2024.06-1 contain a local privilege escalation vulnerability when installed outside the user's home directory.Check if you run itEPSS 0.20%Dec 17, 2025
- High7.5In jose4j before 0.9.6, an attacker can cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratCheck if you run itEPSS 0.26%Dec 17, 2025
- Medium5.3In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) tCheck if you run itEPSS 0.19%Dec 17, 2025
- Critical9.8Netaxis API Orchestrator (APIO) before 0.19.3 allows server side template injection (SSTI).Check if you run itEPSS 0.50%Dec 17, 2025
- High8.8Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Check if you run itEPSS 3.25%Dec 16, 2025
- High8.8Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Check if you run itEPSS 3.00%Dec 16, 2025
Sort