Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.1Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low-privileged observerCheck if you run itEPSS 0.32%Nov 6, 2025
- Medium5.3Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated low-privileged observCheck if you run itEPSS 0.31%Nov 6, 2025
- Medium5.3Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authenticated low-privilegedCheck if you run itEPSS 0.31%Nov 6, 2025
- Medium5.3Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authenticated low-privilegedCheck if you run itEPSS 0.31%Nov 6, 2025
- Medium5.3Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privilegeCheck if you run itEPSS 0.31%Nov 6, 2025
- High8.6Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-privileged observer useCheck if you run itEPSS 0.31%Nov 6, 2025
- Medium5.3Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated low-privileged observeCheck if you run itEPSS 0.31%Nov 6, 2025
- High8.6Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged obseCheck if you run itEPSS 0.31%Nov 6, 2025
- High8.6Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administCheck if you run itEPSS 1.70%Nov 6, 2025
- Medium6.9Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an aCheck if you run itEPSS 0.41%Nov 6, 2025
- Medium6.3Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction().Check if you run itEPSS 0.22%Nov 6, 2025
- Medium6.2Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction().Check if you run itEPSS 0.22%Nov 6, 2025
- High7.3runc is a CLI tool for spawning and running containers according to the OCI specification.Check if you run itEPSS 1.24%Nov 6, 2025
- Medium6.7Dell Integrated Dell Remote Access Controller 9, 14G versions prior to 7.00.00.181, 15G and 16G versions 6.10.80.00 through 7.20.10.50 and Dell Integrated Dell Remote Access ControCheck if you run itEPSS 0.46%Nov 6, 2025
- High7.3containerd is an open-source container runtime.Check if you run itEPSS 0.17%Nov 6, 2025
- Medium5.3An ownership verification issue in the Virtual Desktop preview page in the Research and Engineering Studio (RES) on AWS before version 2025.09 may allow an authenticated remote useCheck if you run itEPSS 0.31%Nov 6, 2025
- High7.8A maliciously crafted file, when executed on the victim's machine, can lead to privilege escalation to NT AUTHORITY/SYSTEM due to an insufficient validation of loaded binaries.Check if you run itEPSS 0.16%Nov 6, 2025
- High8.8Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by replaying the pre-MFCheck if you run itEPSS 0.60%Nov 6, 2025
- Medium6.5Improper access control in Devolutions allows a View-only user to retrieve sensitive third-level nested fields, such as password lists custom values, resulting in password disclosuCheck if you run itEPSS 0.43%Nov 6, 2025
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Alloggio - Hotel Booking alloggio allows PHP LoCheck if you run itEPSS 0.43%Nov 6, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc Import from YML import-from-yml allows Reflected XSS.This issue affecCheck if you run itEPSS 0.19%Nov 6, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-postCheck if you run itEPSS 0.19%Nov 6, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appscreo Easy Social Share Buttons easy-social-share-buttons3 allows ReflectedCheck if you run itEPSS 0.18%Nov 6, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Reflected XSS.ThisCheck if you run itEPSS 0.19%Nov 6, 2025
- Critical10.0Unrestricted Upload of File with Dangerous Type vulnerability in KingAddons.com King Addons for Elementor king-addons allows Upload a Web Shell to a Web Server.This issue affects KCheck if you run itEPSS 0.45%Nov 6, 2025
Sort