Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1An authenticated cross-site scripting (XSS) vulnerability in the Administrative interface of Radware AlteonOS Web UI Management v33.0.4.50 allows attackers to execute arbitrary webCheck if you run itEPSS 0.21%Oct 1, 2025
- High8.8A stored cross-site scripting (XSS) in Kissflow Work Platform Kissflow Application Versions 7337 Account v2.0 to v4.2vallows attackers to execute arbitrary web scripts or HTML viaCheck if you run itEPSS 0.34%Oct 1, 2025
- Medium5.4A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to execute arbitrary Javascript in the contextCheck if you run itEPSS 0.18%Oct 1, 2025
- Medium5.5Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.Check if you run itEPSS 0.33%Oct 1, 2025
- High8.8Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter.Check if you run itEPSS 0.50%Oct 1, 2025
- High8.8File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality.Check if you run itEPSS 0.52%Oct 1, 2025
- Medium4.6Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rendered by other users.Check if you run itEPSS 0.29%Oct 1, 2025
- High8.2In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to SQL Injection, whichCheck if you run itEPSS 0.33%Oct 1, 2025
- High8.2In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Injection, which allows aCheck if you run itEPSS 0.34%Oct 1, 2025
- High8.2In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all informationCheck if you run itEPSS 0.33%Oct 1, 2025
- High8.2In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable to SQL Injection, whicCheck if you run itEPSS 0.34%Oct 1, 2025
- High8.1A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0.10.5 allows attackers to cause a Denial of Service (DoS) by supplying a crafted PDF file.Check if you run itEPSS 0.40%Oct 1, 2025
- Low2.9Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.gCheck if you run itEPSS 0.13%Oct 1, 2025
- High8.8A CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute arbitrary code via supplying a crafted HTTP request.Check if you run itEPSS 0.44%Oct 1, 2025
- Medium6.5Cross Site Scripting vulnerability in Neto E-Commerce CMS v.6.313.0 through v.6.3115 allows a remote attacker to escalate privileges via the kw parameter.Check if you run itEPSS 0.34%Oct 1, 2025
- High8.7Keysight Ixia Vision has an issue with hardcoded cryptographic material which may allow an attacker to intercept or decrypt payloads sent to the device via API calls or user authenCheck if you run itEPSS 0.26%Sep 30, 2025
- Medium6.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.Check if you run itEPSS 0.48%Sep 30, 2025
- Medium4.8Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 thCheck if you run itEPSS 0.22%Sep 30, 2025
- Critical9.3The Telenium Online Web Application is vulnerable due to a PHP endpoint accessible to unauthenticated network users that improperly handles user-supplied input.Check if you run itEPSS 1.21%Sep 30, 2025
- Medium4.9IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive informCheck if you run itEPSS 0.30%Sep 30, 2025
- Medium5.4IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting.Check if you run itEPSS 0.19%Sep 30, 2025
- Medium5.3Insecure Direct Object Reference (IDOR) vulnerability with audit events in Liferay Portal 7.4.0 through 7.4.3.117, and older unsupported versions, and Liferay DXP 2024.Q1.1 throughCheck if you run itEPSS 0.29%Sep 30, 2025
- Low3.3Rapid7 AppSpider Pro versions below 7.5.021 suffer from a project name validation vulnerability, whereby an attacker can change the project name directly in the configuration fileCheck if you run itEPSS 0.09%Sep 30, 2025
- High8.7NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an User/Attacker may cause an authorized action.Check if you run itEPSS 0.24%Sep 30, 2025
- Medium4.6NVIDIA Delegated Licensing Service for all appliance platforms contains a SQL injection vulnerability where an User/Attacker may cause an authorized action.Check if you run itEPSS 0.22%Sep 30, 2025
Sort