Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in hoernerfranz WP-CalDav2ICS wp-caldav2ics allows Stored XSS.This issue affects WP-CalDav2ICS: from n/a through <= 1.3.4.Check if you run itEPSS 0.11%Dec 30, 2025
- Medium5.1ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attackers to inject malicious HTML and JavaScriCheck if you run itEPSS 0.35%Dec 30, 2025
- Critical9.3Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML file after authenticatioCheck if you run itEPSS 0.55%Dec 30, 2025
- Critical9.3Ksenia Security lares (legacy model) Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload MPFS File System binarCheck if you run itEPSS 0.47%Dec 30, 2025
- Medium5.1Ksenia Security lares (legacy model) version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 'redirectPage' GET paramCheck if you run itEPSS 0.26%Dec 30, 2025
- Critical9.3Ksenia Security lares (legacy model) version 1.6 contains a default credentials vulnerability that allows unauthorized attackers to gain administrative access.Check if you run itEPSS 0.58%Dec 30, 2025
- High8.6Anevia Flamingo XL 3.2.9 contains a restricted shell vulnerability that allows remote attackers to escape the sandboxed environment through the traceroute command.Check if you run itEPSS 0.78%Dec 30, 2025
- High8.7Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configurations.Check if you run itEPSS 0.24%Dec 30, 2025
- High8.7Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requesting the video.cgi endpoint on port 8080.Check if you run itEPSS 0.39%Dec 30, 2025
- High8.5Tosibox Key Service 3.3.0 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges.Check if you run itEPSS 0.23%Dec 30, 2025
- High8.8NLB mKlik Macedonia 3.3.12 contains a SQL injection vulnerability in international transfer parameters that allows attackers to manipulate database queries.Check if you run itEPSS 0.34%Dec 30, 2025
- Critical9.3Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed.Check if you run itEPSS 0.65%Dec 30, 2025
- Medium5.1JM-DATA ONU JF511-TV version 1.0.67 is vulnerable to cross-site request forgery (CSRF) attacks, allowing attackers to perform administrative actions on behalf of authenticated userCheck if you run itEPSS 0.26%Dec 30, 2025
- Critical9.3JM-DATA ONU JF511-TV version 1.0.67 uses default credentials that allow attackers to gain unauthorized access to the device with administrative privileges.Check if you run itEPSS 0.42%Dec 30, 2025
- Medium5.1JM-DATA ONU JF511-TV version 1.0.67 is vulnerable to authenticated stored cross-site scripting (XSS) attacks, allowing attackers with authenticated access to inject malicious scripCheck if you run itEPSS 0.26%Dec 30, 2025
- Medium6.9H3C SSL VPN contains a user enumeration vulnerability that allows attackers to identify valid usernames through the 'txtUsrName' POST parameter.Check if you run itEPSS 0.37%Dec 30, 2025
- High7.1Fetch FTP Client 5.8.2 contains a denial of service vulnerability that allows attackers to trigger 100% CPU consumption by sending long server responses.Check if you run itEPSS 0.42%Dec 30, 2025
- Critical9.3SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality with path traversal flaw.Check if you run itEPSS 1.57%Dec 30, 2025
- High8.5SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory.Check if you run itEPSS 4.16%Dec 30, 2025
- Critical9.3SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter.Check if you run itEPSS 3.66%Dec 30, 2025
- High8.7SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an authenticated command injection vulnerability in the www-data-handler.php script that allows attackers to inject system commands thrCheck if you run itEPSS 3.13%Dec 30, 2025
- High8.7SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive system files.Check if you run itEPSS 1.57%Dec 30, 2025
- High8.5SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory.Check if you run itEPSS 3.76%Dec 30, 2025
- Medium6.9SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated vulnerability that allows remote attackers to access live radio stream information through webplay oCheck if you run itEPSS 0.79%Dec 30, 2025
- High8.5SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory with .dns.pid eCheck if you run itEPSS 4.20%Dec 30, 2025
Sort