Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.3TOTOLINK N300RT wireless router firmware versions prior to V3.4.0-B20250430 (discovered in V2.1.8-B20201030.1539) contain an OS command injection vulnerability in the…Check if you run itEPSS 4.36%Dec 3, 2025
- Medium6.5An Improper Input Validation vulnerability exists in the user websocket handler of MAAS.Check if you run itEPSS 0.27%Dec 3, 2025
- Medium4.3The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5.Check if you run itEPSS 0.12%Dec 3, 2025
- Medium5.3Sending an HTTP request/response body with greater than 2^31 bytes triggers an infinite loop in proxygen::coro::HTTPQuicCoroSession which blocks the backing event loop…Check if you run itEPSS 0.29%Dec 2, 2025
- Critical9.3A vulnerability in Longwatch devices allows unauthenticated HTTP GET requests to execute arbitrary code via an exposed endpoint, due to the absence of code signing and…Check if you run itEPSS 0.68%Dec 2, 2025
- High7.6The MCP Python SDK, called on PyPI, is a Python implementation of the Model Context Protocol (MCP).Check if you run itEPSS 0.51%Dec 2, 2025
- High7.6MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients.Check if you run itEPSS 0.51%Dec 2, 2025
- Medium6.9Horde Groupware v5.2.22 has a user enumeration vulnerability that allows an unauthenticated attacker to determine the existence of valid accounts on the system.Check if you run itEPSS 0.24%Dec 2, 2025
- Medium4.3The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8.Check if you run itEPSS 0.16%Dec 2, 2025
- Medium4.3The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20.Check if you run itEPSS 0.15%Dec 2, 2025
- Medium6.5The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.19.Check if you run itEPSS 0.16%Dec 2, 2025
- Medium6.9fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server.Check if you run itEPSS 0.18%Dec 1, 2025
- Medium6.9Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails.Check if you run itEPSS 0.37%Dec 1, 2025
- Low2.1A vulnerability has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1.Check if you run itEPSS 0.33%Dec 1, 2025
- Low2.1A security vulnerability has been detected in deco-cx apps up to 0.120.1.Check if you run itEPSS 0.32%Dec 1, 2025
- Medium5.8A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass.Check if you run itEPSS 0.39%Nov 30, 2025
- Medium5.5A security flaw has been discovered in Qualitor up to 8.20.104/8.24.97.Check if you run itEPSS 0.46%Nov 30, 2025
- Low2.1A vulnerability was determined in Scada-LTS up to 2.7.8.1.Check if you run itEPSS 0.26%Nov 30, 2025
- Low2.1A vulnerability was found in ZenTao up to 21.7.6-8564.Check if you run itEPSS 0.29%Nov 30, 2025
- Medium5.3OrangeHRM is a comprehensive human resource management (HRM) system.Check if you run itEPSS 0.20%Nov 29, 2025
- Medium5.3OrangeHRM is a comprehensive human resource management (HRM) system.Check if you run itEPSS 0.19%Nov 29, 2025
- High8.7OrangeHRM is a comprehensive human resource management (HRM) system.Check if you run itEPSS 0.18%Nov 29, 2025
- UnknownWSO2 api_control_plane Authentication Bypass by SpoofingPatch nowKEVEPSS 0.85%Nov 28, 2025
- Unknownmaptiler tileserver_php Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 1.40%Nov 27, 2025
- Unknownimgproxy imgproxy Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 0.88%Nov 27, 2025
Sort