Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5Same-origin policy bypass in the CSS Parsing and Computation component.Check if you run itEPSS 0.13%Mar 10, 2026
- High8.8Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android.Check if you run itEPSS 0.52%Mar 10, 2026
- Medium4.6Cross-site Scripting (XSS) allows an attacker to submit specially crafted data to the application which is returned unaltered in the resulting web page.Check if you run itEPSS 0.22%Mar 10, 2026
- High7.8An exposed dangerous method in Ivanti DSM before version 2026.1.1 allows a local authenticated attacker to escalate their privileges.Check if you run itEPSS 0.46%Mar 10, 2026
- High7.5CGA-xgvj-vgm7-vx2qOpen the advisoryMar 10, 2026
- Medium6.1CGA-w6j4-5c3c-g8m6Open the advisoryMar 10, 2026
- Medium6.1CGA-hrm3-v923-jpq4Open the advisoryMar 10, 2026
- High8.5CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sendsCheck if you run itEPSS 0.22%Mar 10, 2026
- High7.5CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator credentCheck if you run itEPSS 0.72%Mar 10, 2026
- Medium5.3An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring SeCheck if you run itEPSS 0.45%Mar 10, 2026
- Low2.3Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 15.0.0 through 23.6.6, 24.0.0 tCheck if you run itEPSS 0.39%Mar 10, 2026
- Low2.5CGA-j4m8-w563-wr25Open the advisoryMar 10, 2026
- Medium6.1The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and the local host machineCheck if you run itEPSS 0.09%Mar 10, 2026
- Low3.3HCL Sametime for Android is impacted by a sensitive information disclosure.Check if you run itEPSS 0.15%Mar 10, 2026
- Medium6.4The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode in all versions up to, and including, 4.4.6.Check if you run itEPSS 4.24%Mar 10, 2026
- High7.2The Unlimited Elements for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form entry fields in all versions up to, and including, 2.0.5.Check if you run itEPSS 0.39%Mar 10, 2026
- Medium5.3This issue affects the ExtractEmbeddedFiles example in Apache PDFBox: from 2.0.24 through 2.0.35, from 3.0.0 through 3.0.6.Check if you run itEPSS 0.99%Mar 10, 2026
- Medium5.8Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Visionline on Windows alCheck if you run itEPSS 0.12%Mar 10, 2026
- High7.2The MetForm Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Quiz feature in all versions up to, and including, 3.9.6 due to insufficient input sanitizCheck if you run itEPSS 0.36%Mar 10, 2026
- Medium6.5An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive information on the device.Check if you run itEPSS 0.45%Mar 10, 2026
- Medium5.3An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access.Check if you run itEPSS 0.35%Mar 10, 2026
- Medium6.5An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server with limited read and write privileges.Check if you run itEPSS 0.44%Mar 10, 2026
- Critical9.8An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affected device.Check if you run itEPSS 2.45%Mar 10, 2026
- High7.3If a legitimate user confirms a self-update prompt or initiate an installation of a CODESYS Development System, a low privileged local attacker can gain elevated rights due to a TOCheck if you run itEPSS 0.10%Mar 10, 2026
- Medium4.3The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete them via aCheck if you run itEPSS 0.14%Mar 10, 2026
Sort