Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low1.8Anthropic Sandbox Runtime is a lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.Check if you run itEPSS 0.16%Dec 4, 2025
- High8.7Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.24%Dec 4, 2025
- High8.9Remote Keyboard Desktop 1.0.1 enables remote attackers to execute system commands via the rundll32.exe exported function export, allowing unauthenticated code execution.Check if you run itEPSS 1.25%Dec 4, 2025
- High8.5VeeVPN 1.6.1 contains an unquoted service path vulnerability in the VeePNService that allows remote attackers to execute code during startup or reboot with escalated privileges.Check if you run itEPSS 0.46%Dec 4, 2025
- Medium5.3TranzAxis 3.2.41.10.26 allows authenticated users to inject cross-site scripting via the endpoint, allowing attackers to steal session cookies and potentially escalate privileges.Check if you run itEPSS 0.24%Dec 4, 2025
- Medium6.9Solstice Pod API (version 5.5, 6.2) contains an unauthenticated API endpoint ( ) that exposes sensitive information such as the session key, server version, product details, and diCheck if you run itEPSS 0.30%Dec 4, 2025
- Medium6.9Loaded Commerce 6.6 contains a client-side template injection vulnerability via the search parameter that allows unauthenticated attackers to execute arbitrary code in the victim'sCheck if you run itEPSS 0.48%Dec 4, 2025
- Critical9.3UNA CMS versions 9.0.0-RC1 - 14.0.0-RC4 contain a PHP object injection vulnerability in BxBaseMenuSetAclLevel.php where the profile_id POST parameter is passed to PHP unserialize()Check if you run itEPSS 0.61%Dec 4, 2025
- High8.8AirKeyboard iOS App 1.0.5 contains a missing authentication vulnerability that allows unauthenticated attackers to type arbitrary keystrokes directly into the victim's iOS device iCheck if you run itEPSS 0.68%Dec 4, 2025
- High8.5perl2exe <= V30.10C contains an arbitrary code execution vulnerability that allows local authenticated attackers to execute malicious scripts.Check if you run itEPSS 0.19%Dec 4, 2025
- High8.7R Radio Network FM Transmitter 1.07 allows unauthenticated attackers to access the admin user's password through the system.cgi endpoint, enabling authentication bypass and FM statCheck if you run itEPSS 0.43%Dec 4, 2025
- High8.7Obi08/Enrollment System 1.0 contains a SQL injection vulnerability in the keyword parameter of /get_subject.php that allows unauthenticated attackers to execute arbitrary SQL queriCheck if you run itEPSS 0.41%Dec 4, 2025
- High8.7Easywall 0.3.1 allows authenticated remote command execution via a command injection vulnerability in the /ports-save endpoint that suffers from a parameter injection flaw.Check if you run itEPSS 1.80%Dec 4, 2025
- Medium5.3WEBIGniter 28.7.23 contains a cross-site scripting vulnerability in the user creation process that allows unauthenticated attackers to execute malicious JavaScript code, enabling pCheck if you run itEPSS 0.41%Dec 4, 2025
- High8.7dawa-pharma-1.0 allows unauthenticated attackers to execute SQL queries on the server, allowing them to access sensitive information and potentially gain administrative access.Check if you run itEPSS 0.53%Dec 4, 2025
- High8.6The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly.Check if you run itEPSS 0.51%Dec 4, 2025
- High8.8The PostGallery plugin for WordPress is vulnerable to arbitrary file uploads due to incorrect file type validation in the 'PostGalleryUploader' class functions in all versions up tCheck if you run itEPSS 0.76%Dec 4, 2025
- Low2.2Insecure Direct Object Reference vulnerability in Medtronic CareLink Network which allows an authenticated attacker with access to specific device and user information to submit weCheck if you run itEPSS 0.18%Dec 4, 2025
- Medium4.1Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under certain circumstances.Check if you run itEPSS 0.11%Dec 4, 2025
- High8.1Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certaCheck if you run itEPSS 0.33%Dec 4, 2025
- Medium5.3Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to determine a valid user acCheck if you run itEPSS 0.30%Dec 4, 2025
- High8.5Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 4.43%Dec 4, 2025
- Medium5.1Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories.Check if you run itEPSS 0.33%Dec 4, 2025
- High8.7There is a relative path traversal vulnerability in the NI System Web Server that may result in information disclosure.Check if you run itEPSS 0.62%Dec 4, 2025
- High7.5auth0/node-jws is a JSON Web Signature implementation for Node.js.Check if you run itEPSS 0.21%Dec 4, 2025
Sort