Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet.Check if you run itEPSS 0.37%Oct 13, 2026
- Medium5.9The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails.Check if you run itEPSS 0.16%Oct 13, 2026
- Medium5.7The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a static pool of CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_COUNT…Check if you run itEPSS 0.18%Oct 13, 2026
- Medium5.5A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3.Check if you run itEPSS 0.47%Oct 13, 2026
- UnknownMalicious code in monkey-tags-ip (npm)Open the advisoryOct 13, 2026
- UnknownMalicious code in @user-interface-common/common-styles (npm)Open the advisoryOct 13, 2026
- UnknownMalicious code in @newspage/lib-ng-async-routes-ui (npm)Open the advisoryOct 13, 2026
- UnknownMalicious code in @mntv-analysis/workspaces-components (npm)Open the advisoryOct 13, 2026
- UnknownMalicious code in @mntv-analysis/ui-components (npm)Open the advisoryOct 13, 2026
- UnknownMalicious code in @mntv-analysis/ui (npm)Open the advisoryOct 13, 2026
- HighThe WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter…Check if you run itEPSS 0.32%Oct 13, 2026
- MediumGitea private repository access retained after rejected transferCheck if you run itEPSS 0.21%Oct 13, 2026
- HighGitea expanded a workflow's static into its full Cartesian product without a size limit when creating a run, before the fork pull request approval gate applied.Check if you run itEPSS 0.35%Oct 13, 2026
- HighThe Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions'…Check if you run itEPSS 0.24%Oct 13, 2026
- HighThe WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.…Check if you run itEPSS 0.25%Oct 13, 2026
- CriticalIBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation.Check if you run itEPSS 0.51%Oct 13, 2026
- UnknownMicrosoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass VulnerabilityCheck if you run itEPSS 0.83%Oct 13, 2026
- High7.5Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service VulnerabilityCheck if you run itEPSS 0.85%Oct 13, 2026
- UnknownMicrosoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege VulnerabilityCheck if you run itEPSS 0.64%Oct 13, 2026
- Low3.8A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requestsCheck if you run itEPSS 0.21%Oct 13, 2026
- High8.8SQL command injection in webmailCheck if you run itEPSS 0.30%Oct 13, 2026
- UnknownServer-Side Request Forgery (SSRF)Patch nowKEVEPSS 0.47%Oct 13, 2026
- Unknownvanquish woocommerce_customers_manager Cross-Site Request Forgery (CSRF)Patch nowKEVEPSS 0.32%Oct 13, 2026
- High7.5IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system.Check if you run itEPSS 0.36%Oct 12, 2026
- Critical9.8IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.Check if you run itEPSS 0.34%Oct 12, 2026