Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd.Check if you run itEPSS 0.26%Oct 23, 2025
- Medium5.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArkSigner Software and Hardware Inc.Check if you run itEPSS 0.22%Oct 23, 2025
- Medium5.1GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function.Check if you run itEPSS 0.20%Oct 23, 2025
- Medium4.6Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page.Check if you run itEPSS 0.23%Oct 23, 2025
- Medium4.6Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page.Check if you run itEPSS 0.23%Oct 23, 2025
- Critical10.0Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.Check if you run itEPSS 0.41%Oct 23, 2025
- Medium5.5Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will.Check if you run itEPSS 0.13%Oct 23, 2025
- Medium6.7Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specCheck if you run itEPSS 0.10%Oct 23, 2025
- Critical9.9Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site perCheck if you run itEPSS 0.34%Oct 23, 2025
- Medium5.5Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks.Check if you run itEPSS 0.14%Oct 23, 2025
- Medium5.5Exposure of Private Personal Information to an Unauthorized Actor (CWE-359) in the Command Centre Server allows a privileged Operator to view limited personal data about a CardholdCheck if you run itEPSS 0.13%Oct 23, 2025
- High8.8Incorrect Default Permissions vulnerability in MongoDB Atlas SQL ODBC driver on Windows allows Privilege Escalation.This issue affects MongoDB Atlas SQL ODBC driver: from 1.0.0 thrCheck if you run itEPSS 0.14%Oct 23, 2025
- Medium4.9Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.Check if you run itEPSS 0.22%Oct 23, 2025
- Medium6.5gnuboard gnuboard4 v4.36.04 and before is vulnerable to Second-order SQL Injection via the search_table in bbs/search.php.Check if you run itEPSS 0.23%Oct 23, 2025
- High7.1A Host Header Injection vulnerability in the password reset component in axewater sharewarez v2.4.3 allows remote attackers to conduct password reset poisoning and account takeoverCheck if you run itEPSS 0.45%Oct 23, 2025
- High7.1A Host Header Injection vulnerability in the password reset component in levlaz braindump v0.4.14 allows remote attackers to conduct password reset poisoning and account takeover vCheck if you run itEPSS 0.37%Oct 23, 2025
- Medium6.1Cross Site Scripting (XSS) vulnerability in Gnuboard 5.6.15 allows authenticated attackers to execute arbitrary code via crafted c_id parameter in bbs/view_comment.php.Check if you run itEPSS 0.28%Oct 23, 2025
- Medium6.5A CSV Injection vulnerability existed in Instant Developer Foundation versions prior to 25.0.9600.Check if you run itEPSS 0.41%Oct 23, 2025
- Medium6.1A reflected cross-site scripting (XSS) vulnerability in MCMS v6.0.1 allows attackers to execute arbitrary Javascript in the context of a user's browser via a crafted payload.Check if you run itEPSS 0.20%Oct 23, 2025
- Medium6.1Cross site scripting (XSS) vulnerability in 17gz International Student service system 1.0 allows attackers to execute arbitrary code via the registration step.Check if you run itEPSS 0.23%Oct 23, 2025
- Medium5.3Cross site request forgery (CSRF) vulnerability in KeeneticOS before 4.3 at "/rci" API endpoint allows attackers to take over the device via adding additional users with full permiCheck if you run itEPSS 0.18%Oct 23, 2025
- Medium6.1Cross site scripting (XSS) vulnerability in KeeneticOS before 4.3 at "Wireless ISP" page allows attackers located near to the router to takeover the device via adding additional usCheck if you run itEPSS 0.24%Oct 23, 2025
- Medium6.5CRLF-injection in KeeneticOS before 4.3 at "/auth" API endpoint allows attackers to take over the device via adding additional users with full permissions by managing the victim toCheck if you run itEPSS 0.34%Oct 23, 2025
- Medium4.3An issue was discovered in BAE SOCET GXP before 4.6.0.2.Check if you run itEPSS 0.24%Oct 23, 2025
- Medium6.5An issue was discovered in BAE SOCET GXP before 4.6.0.2.Check if you run itEPSS 0.69%Oct 23, 2025
Sort