Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Unknownprocess: command injection via argument list on WindowsCheck if you run itEPSS 6.83%Nov 14, 2025
- Unknownxml-conduit unbounded entity expansionCheck if you run itEPSS 0.84%Nov 14, 2025
- Unknowngit-annex private data exfiltration to compromised remoteCheck if you run itEPSS 1.54%Nov 14, 2025
- High7.1Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access.Check if you run itEPSS 0.31%Nov 14, 2025
- Medium6.0In Search Guard FLX versions 3.1.2 and earlier, while Document-Level Security (DLS) is correctly enforced elsewhere, when the search is triggered from a Signals watch, the DLS ruleCheck if you run itEPSS 0.30%Nov 14, 2025
- High7.1Rockwell Automation Arena® suffers from a stack-based buffer overflow vulnerability.Check if you run itEPSS 0.17%Nov 14, 2025
- Medium4.8QuickCMS is vulnerable to multiple Stored XSS in language editor functionality (languages).Check if you run itEPSS 0.21%Nov 14, 2025
- Medium6.9A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext.Check if you run itEPSS 0.28%Nov 14, 2025
- High8.1Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in OptimusCheck if you run itEPSS 0.39%Nov 14, 2025
- Medium4.9The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'SCodes' parameter in all versions up to, and including, 2.2.23 due to insuCheck if you run itEPSS 0.33%Nov 14, 2025
- Medium4.9Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to sanitize user data which allows system administrators to access password hashes and MFA secretCheck if you run itEPSS 0.30%Nov 14, 2025
- Medium5.4Mattermost versions 10.11.x <= 10.11.3, 10.5.x <= 10.5.11, 10.12.x <= 10.12.0 fail to validate the relationship between the post being updated and the MSTeams plugin OAuth flow whiCheck if you run itEPSS 0.20%Nov 14, 2025
- Medium6.5Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket eventsCheck if you run itEPSS 0.32%Nov 14, 2025
- Low3.1Mattermost versions <11.0 fail to properly enforce the "Allow users to view archived channels" setting which allows regular users to access archived channel content and files via tCheck if you run itEPSS 0.18%Nov 14, 2025
- Medium4.3Mattermost versions <11 fail to properly restrict access to archived channel search API which allows guest users to discover archived public channels via the endpointCheck if you run itEPSS 0.21%Nov 14, 2025
- High7.2The Creta Testimonial Showcase WordPress plugin before 1.2.4 is vulnerable to Local File Inclusion.Check if you run itEPSS 0.52%Nov 14, 2025
- High8.6Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1.4.48.16 and earlier.Check if you run itEPSS 1.21%Nov 14, 2025
- High8.7IQ-Support developed by IQ Service International has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to downloadCheck if you run itEPSS 0.57%Nov 14, 2025
- Medium6.9IQ-Support developed by IQ Service International has a Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to access specific APIs to obtainCheck if you run itEPSS 0.33%Nov 14, 2025
- Medium4.3Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page.Check if you run itEPSS 0.21%Nov 14, 2025
- Medium4.3Inappropriate implementation in Autofill in Google Chrome on Windows prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page.Check if you run itEPSS 0.23%Nov 14, 2025
- Medium4.3Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page.Check if you run itEPSS 0.25%Nov 14, 2025
- High7.5Use after free in Internals in Google Chrome on iOS prior to 127.0.6533.88 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit hCheck if you run itEPSS 0.27%Nov 14, 2025
- High7.5Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.Check if you run itEPSS 0.24%Nov 14, 2025
- Medium4.3Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page.Check if you run itEPSS 0.19%Nov 14, 2025
Sort