Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.1OpenBao's AWS Plugin generates AWS access credentials based on IAM policies.Check if you run itEPSS 0.27%Oct 23, 2025
- UnknownAn acceptance of extraneous untrusted data with trusted data vulnerability has been identified in Moxa’s Ethernet switches, which allows attackers with administrative privileges toCheck if you run itEPSS 0.18%Oct 23, 2025
- Medium4.8Cross-site Scripting has been identified in Moxa’s Ethernet switches, which allows an authenticated administrative attacker to inject malicious scripts to an affected device’s webCheck if you run itEPSS 0.33%Oct 23, 2025
- Medium6.9Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsuCheck if you run itEPSS 0.40%Oct 23, 2025
- Medium4.8Vilar VS-IPC1002 IP cameras are vulnerable to Reflected XSS (Cross-site Scripting) attacks, because parameters in GET requests sent to /cgi-bin/action endpoint are not sanitized prCheck if you run itEPSS 0.22%Oct 23, 2025
- High7.1Vilar VS-IPC1002 IP cameras are vulnerable to DoS (Denial-of-Service) attacks.Check if you run itEPSS 0.23%Oct 23, 2025
- Medium6.4The Beaver Builder Plugin (Starter Version) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play’ parameter in all versions up to, and including, 2.Check if you run itEPSS 0.18%Oct 23, 2025
- Medium5.0The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions uCheck if you run itEPSS 0.29%Oct 23, 2025
- Medium5.3The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.4.6.Check if you run itEPSS 0.29%Oct 23, 2025
- Critical9.8Inclusion of Functionality from Untrusted Control Sphere, Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ACheck if you run itEPSS 0.57%Oct 23, 2025
- Medium5.4An issue in Moodle’s timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.Check if you run itEPSS 0.22%Oct 23, 2025
- Medium4.3A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative dCheck if you run itEPSS 0.25%Oct 23, 2025
- Medium4.3Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups.Check if you run itEPSS 0.27%Oct 23, 2025
- High7.5Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.Check if you run itEPSS 0.40%Oct 23, 2025
- Medium5.4A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.Check if you run itEPSS 0.25%Oct 23, 2025
- Medium5.3The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.Check if you run itEPSS 0.28%Oct 23, 2025
- Medium5.3An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.Check if you run itEPSS 0.30%Oct 23, 2025
- Medium4.3Moodle failed to verify enrolment status correctly when sending quiz notifications.Check if you run itEPSS 0.23%Oct 23, 2025
- Medium4.3A flaw was found in the course overview output function where user access permissions were not fully enforced.Check if you run itEPSS 0.24%Oct 23, 2025
- Medium5.1Open redirection vulnerability in MOLGENIS EMX2 v11.14.0.Check if you run itEPSS 0.30%Oct 23, 2025
- High7.1Path Traversal vulnerability in version 4.4.2236.1 of TESI Gandia Integra Total.Check if you run itEPSS 0.38%Oct 23, 2025
- Medium5.1Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POCheck if you run itEPSS 0.21%Oct 23, 2025
- Medium4.8QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form).Check if you run itEPSS 0.21%Oct 23, 2025
- Medium4.8QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form).Check if you run itEPSS 0.21%Oct 23, 2025
- High7.5A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communications.Check if you run itEPSS 0.46%Oct 23, 2025
Sort