Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownStarOffice /tmp directory symbolic link attack could be used to gain file privileges CVE-2000-1156 Vulnerability ReportCheck if you run itEPSS 0.45%Mar 6, 2026
- High8.7Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment.Check if you run itEPSS 0.52%Mar 6, 2026
- High8.2Zarf is an Airgap Native Packager Manager for Kubernetes.Check if you run itEPSS 0.26%Mar 6, 2026
- High7.7CoreDNS is a DNS server that chains plugins.Check if you run itEPSS 0.42%Mar 6, 2026
- High7.5CoreDNS is a DNS server that chains plugins.Check if you run itEPSS 1.24%Mar 6, 2026
- Medium6.9Charging station authentication identifiers are publicly accessible via web-based mapping platforms.Check if you run itEPSS 0.26%Mar 6, 2026
- Medium6.9The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier.Check if you run itEPSS 0.29%Mar 6, 2026
- High8.7The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests.Check if you run itEPSS 0.41%Mar 6, 2026
- Critical9.3WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend.Check if you run itEPSS 0.66%Mar 6, 2026
- Medium6.9Charging station authentication identifiers are publicly accessible via web-based mapping platforms.Check if you run itEPSS 0.28%Mar 6, 2026
- Medium6.9The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier.Check if you run itEPSS 0.34%Mar 6, 2026
- High8.7The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests.Check if you run itEPSS 0.50%Mar 6, 2026
- High7.5Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints.Check if you run itEPSS 0.57%Mar 6, 2026
- High7.5An Absolute Path Traversal vulnerability exists in Navtor NavBox.Check if you run itEPSS 0.53%Mar 6, 2026
- Medium5.3Navtor NavBox allows information disclosure via the /api/ais-data endpoint.Check if you run itEPSS 0.31%Mar 6, 2026
- Critical9.3WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend.Check if you run itEPSS 0.90%Mar 6, 2026
- High8.8GPS Tracking System 2.12 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the usern…Check if you run itEPSS 0.32%Mar 6, 2026
- Medium6.9OOP CMS BLOG 1.0 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by crafting malicious POST requestCheck if you run itEPSS 0.18%Mar 6, 2026
- High8.8OOP CMS BLOG 1.0 contains SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through multiple parameterCheck if you run itEPSS 0.41%Mar 6, 2026
- Medium6.9eToolz 3.4.8.0 contains a denial of service vulnerability that allows local attackers to crash the application by supplying oversized input buffers.Check if you run itEPSS 0.14%Mar 6, 2026
- High8.8PlayJoom 0.10.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the catid parametCheck if you run itEPSS 0.27%Mar 6, 2026
- High8.8ServerZilla 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the email parameter.Check if you run itEPSS 0.32%Mar 6, 2026
- High8.8Nominas 0.27 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the username parametCheck if you run itEPSS 0.35%Mar 6, 2026
- High8.7Mongoose Web Server 6.9 contains a denial of service vulnerability that allows remote attackers to crash the service by establishing multiple socket connections.Check if you run itEPSS 0.39%Mar 6, 2026
- High7.1Facturation System 1.0 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'mod_id'Check if you run itEPSS 0.22%Mar 6, 2026
Sort