Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8A post-authentication command injection vulnerability in the "priv" parameter of Zyxel DX3300-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an authenticated attackerCheck if you run itEPSS 1.05%Nov 18, 2025
- High7.5An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker to perform Slowloris‑sCheck if you run itEPSS 0.34%Nov 18, 2025
- Low3.2The Mac App Store distribution of the Canva for Mac desktop app before 1.117.1 was built without Hardened Runtime.Check if you run itEPSS 0.13%Nov 18, 2025
- Medium5.3A vulnerability was determined in itsourcecode Student Information System 1.0.Check if you run itEPSS 0.34%Nov 18, 2025
- Medium6.9A security flaw has been discovered in code-projects Simple Pizza Ordering System 1.0.Check if you run itEPSS 0.48%Nov 18, 2025
- Critical9.8DO NOT USE THIS CVE RECORD.Check this weekEPSS 44.00%Nov 18, 2025
- Medium6.8A vulnerability was determined in SourceCodester Student Grades Management System 1.0.Check if you run itEPSS 0.39%Nov 18, 2025
- Medium5.4A DOM-based cross-site scripting vulnerability exists in electic-shop v1.0 (Bhabishya-123/E-commerce).Check if you run itEPSS 0.27%Nov 18, 2025
- Medium5.3eProsima Fast-DDS v3.3 and before has an infinite loop vulnerability caused by integer overflow in the Time_t:: fraction() function.Check if you run itEPSS 0.34%Nov 18, 2025
- Medium6.1Host Header Injection vulnerability in Backdrop CMS 1.32.1 allows attackers to manipulate the Host header in password reset requests, leading to redirects to malicious domains andCheck if you run itEPSS 0.23%Nov 18, 2025
- High7.5The password change endpoint in Open Source Point of Sale 3.4.1 allows users to set their account password to an empty string due to missing server-side validation.Check if you run itEPSS 0.48%Nov 18, 2025
- Critical9.8DzzOffice v2.3.7 and before is vulnerable to Arbitrary File Upload in /dzz/system/ueditor/php/controller.php.Check if you run itEPSS 0.42%Nov 18, 2025
- Critical9.8DzzOffice v2.3.7 and before is vulnerable to SQL Injection in explorer/groupmanage.Check if you run itEPSS 0.38%Nov 18, 2025
- Medium6.5A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the execute_querCheck if you run itEPSS 0.38%Nov 18, 2025
- Medium6.5A command injection vulnerability exists in the MCP Data Science Server's (reading-plus-ai/mcp-server-data-exploration) 0.1.6 in the safe_eval() function (src/mcp_server_ds/server.Check if you run itEPSS 0.86%Nov 18, 2025
- High7.3A vulnerability was discovered in Awesome Miner thru 11.2.4 that allows arbitrary read and write to kernel memory and MSRs (such as LSTAR) as an unprivileged user.Check if you run itEPSS 0.28%Nov 18, 2025
- Medium6.5kishan0725 Hospital Management System v4 has an Insecure Direct Object Reference (IDOR) vulnerability in the appointment cancellation functionality.Check if you run itEPSS 0.29%Nov 18, 2025
- Medium6.5kishan0725 Hospital Management System/ v4 is vulnerable to SQL Injection in admin-panel1.php, specifically in the deleting doctor logic.Check if you run itEPSS 0.26%Nov 18, 2025
- Medium5.1Local Agent DVR versions thru 6.6.1.0 are vulnerable to directory traversal that allows an unauthenticated local attacker to gain access to sensitive information, cause a server-siCheck if you run itEPSS 0.43%Nov 18, 2025
- Critical9.8The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unauthenticated file upload vulnerability in the /upload_file.php endpoint.Check if you run itEPSS 0.82%Nov 18, 2025
- High7.2The Mozart FM Transmitter web management interface on version WEBMOZZI-00287, contains an unrestricted file upload vulnerability in the /patch.php endpoint.Check if you run itEPSS 0.61%Nov 18, 2025
- Medium5.7The Sencore SMP100 SMP Media Platform (firmware versions V4.2.160, V60.1.4, V60.1.29) is vulnerable to session hijacking due to improper session management on the /UserManagement.hCheck if you run itEPSS 0.22%Nov 18, 2025
- Critical9.8The Eurolab ELTS100_UBX device (firmware version ELTS100v1.UBX) is vulnerable to Broken Access Control due to missing authentication on critical administrative endpoints.Check if you run itEPSS 0.65%Nov 18, 2025
- High8.4Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbCheck if you run itEPSS 0.33%Nov 18, 2025
- High7.2Fortinet FortiWeb OS Command Injection VulnerabilityPatch nowKEVEPSS 54.72%Nov 18, 2025
Sort