Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Infinity 4.2 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource parCheck if you run itEPSS 0.26%Oct 30, 2025
- Medium6.1Cross-site scripting (XSS) vulnerability in Zucchetti Ad Hoc Revolution 4.1 and earlier allows remote unauthenticated attackers to inject arbitrary JavaScript via the pHtmlSource pCheck if you run itEPSS 0.26%Oct 30, 2025
- Critical9.8iib0011 omni-tools v0.4.0 is vulnerable to remote code execution via unsafe JSON deserialization.Check if you run itEPSS 0.66%Oct 30, 2025
- Medium6.1Cross-site scripting (XSS) vulnerability in blog-details.php in Hiruna Gallage's Glamour Salon Management System v1 allows remote attackers to inject arbitrary web script or HTML vCheck if you run itEPSS 0.35%Oct 30, 2025
- Critical9.3kubernetes operations Missing Authentication for Critical FunctionPatch nowKEVEPSS 0.40%Oct 30, 2025
- Critical9.3seeyon zhiyuan_oa_web_application_system Missing Authentication for Critical FunctionPatch nowKEVEPSS 0.49%Oct 30, 2025
- Medium6.3Password enumeration vulnerability in Liferay Portal 7.4.0 through 7.4.3.119, and older unsupported versions, and Liferay DXP 2024.Q1.1 through 2024.Q1.5, 2023.Q4.0 through 2023.Q4Check if you run itEPSS 0.39%Oct 29, 2025
- High7.5Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Simple OAuth (OAuth2) & OpenID Connect allows Authentication Bypass.This issue affects Simple OAuthCheck if you run itEPSS 0.36%Oct 29, 2025
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CivicTheme Design System allows Cross-Site Scripting (XSS).This issue aCheck if you run itEPSS 0.20%Oct 29, 2025
- High7.5Incorrect Authorization vulnerability in Drupal CivicTheme Design System allows Forceful Browsing.This issue affects CivicTheme Design System: from 0.0.0 before 1.12.0.Check if you run itEPSS 0.31%Oct 29, 2025
- Medium5.3Improper Validation of Consistency within Input vulnerability in Drupal Reverse Proxy Header allows Manipulating User-Controlled Variables.This issue affects Reverse Proxy Header:Check if you run itEPSS 0.30%Oct 29, 2025
- Medium6.5Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0.Check if you run itEPSS 0.13%Oct 29, 2025
- Low3.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Umami Analytics allows Cross-Site Scripting (XSS).This issue affects UmCheck if you run itEPSS 0.20%Oct 29, 2025
- Medium6.3Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 before 2.0.5.Check if you run itEPSS 0.24%Oct 29, 2025
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Plausible tracking allows Cross-Site Scripting (XSS).This issue affectsCheck if you run itEPSS 0.19%Oct 29, 2025
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal JSON Field allows Cross-Site Scripting (XSS).This issue affects JSON FiCheck if you run itEPSS 0.20%Oct 29, 2025
- High7.5Missing Authorization vulnerability in Drupal Acquia DAM allows Forceful Browsing.This issue affects Acquia DAM: from 0.0.0 before 1.1.5.Check if you run itEPSS 0.31%Oct 29, 2025
- Medium5.9Cryptographic validation of upgrade images could be circumventing by dropping a specifically crafted file into the upgrade ISOCheck if you run itEPSS 0.09%Oct 29, 2025
- Medium4.3On affected platforms, restricted users could view sensitive portions of the config database via a debug API (e.g., user password hashes)Check if you run itEPSS 0.22%Oct 29, 2025
- Medium5.3On affected platforms, if SSH session multiplexing was configured on the client side, SSH sessions (e.g, scp, sftp) multiplexed onto the same channel could perform file-system operCheck if you run itEPSS 0.11%Oct 29, 2025
- High7.5On affected platforms, restricted users could use SSH port forwarding to access host-internal servicesCheck if you run itEPSS 0.24%Oct 29, 2025
- High7.8On affected platforms, a restricted user could break out of the CLI sandbox to the system shell and elevate their privileges.Check if you run itEPSS 0.13%Oct 29, 2025
- Medium6.9Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET versiCheck if you run itEPSS 0.27%Oct 29, 2025
- High8.7Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain liveCheck if you run itEPSS 0.42%Oct 29, 2025
- High7.8Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability.Check if you run itEPSS 0.21%Oct 29, 2025
Sort