Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Unknownpytorch torchserve Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 42.49%Nov 26, 2025
- Critical9.8OSGeo GeoServer Improper Restriction of XML External Entity Reference VulnerabilityPatch nowKEVEPSS 60.01%Nov 25, 2025
- High7.5An uncontrolled resource consumption vulnerability in the web server of Zyxel DX3301-T0 firmware version 5.50(ABVY.6.3)C0 and earlier could allow an attacker to perfor…Check if you run itEPSS 0.34%Nov 18, 2025
- High7.2Fortinet FortiWeb OS Command Injection VulnerabilityPatch nowKEVEPSS 54.72%Nov 18, 2025
- Unknownhtml2wp_project html2wp Cross-Site Request Forgery (CSRF)Patch nowKEVEPSS 12.19%Nov 18, 2025
- Unknownemby emby Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 87.15%Nov 18, 2025
- High7.5OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.Check if you run itEPSS 0.24%Nov 17, 2025
- Low3.5GitLab has remediated an issue in GitLab EE affecting all versions from 17.8 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attaCheck if you run itEPSS 0.28%Nov 15, 2025
- Medium4.3An issue has been discovered in GitLab CE/EE affecting all versions from 17.6 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2, that, under specific conditions, could haveCheck if you run itEPSS 0.38%Nov 15, 2025
- High8.7General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to send GET requests to obtain sensitive devicCheck if you run itEPSS 0.39%Nov 14, 2025
- High8.7Denver SHO-110 IP cameras expose a secondary HTTP service on TCP port 8001 that provides access to a '/snapshot' endpoint without authentication.Check if you run itEPSS 0.52%Nov 14, 2025
- High8.7Positive Technologies MaxPatrol 8 and XSpider contain a remote denial-of-service vulnerability in the client communication service on TCP port 2002.Check if you run itEPSS 0.49%Nov 14, 2025
- High8.7ReQuest Serious Play F3 Media Server versions 7.0.3.4968 (Pro), 7.0.2.4954, 6.5.2.4954, 6.4.2.4681, 6.3.2.4203, and 2.0.1.823 contain a remote denial-of-service vulnerability.Check if you run itEPSS 0.50%Nov 14, 2025
- Medium6.9Screen SFT DAB 600/C firmware versions up to and including 1.9.3 contain an improper access control on the user management API allows unauthenticated requests to retrieve structureCheck if you run itEPSS 0.37%Nov 14, 2025
- High8.7Ubee EVW3226 cable modem/routers firmware versions up to and including 1.0.20 store configuration backup files in the web root after they are generated for download.Check if you run itEPSS 0.52%Nov 14, 2025
- High8.7Vodafone H500s devices running firmware v3.5.10 (hardware model Sercomm VFH500) expose the WiFi access point password via an unauthenticated HTTP endpoint.Check if you run itEPSS 0.49%Nov 14, 2025
- Medium5.3A vulnerability has been found in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System up to 20250320.Check if you run itEPSS 0.24%Nov 14, 2025
- Medium5.3A vulnerability was detected in Bdtask/CodeCanyon SalesERP up to 20250728.Check if you run itEPSS 0.27%Nov 14, 2025
- Medium5.3A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7.Check if you run itEPSS 0.28%Nov 14, 2025
- Unknowngit-annex private data exfiltration to compromised remoteCheck if you run itEPSS 1.54%Nov 14, 2025
- High7.5Information Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store System allows a remote unauthenticated attacker to disclose full database contents (Check if you run itEPSS 0.48%Nov 14, 2025
- Medium6.0SQL injection (SQL-i) vulnerability in SVX Portal 2.7A via crafted POST request to admin/update_setings.php.Check if you run itEPSS 0.29%Nov 14, 2025
- Medium5.4When processing API requests, the Alteryx server 2022.1.1.42654 and 2024.1 used MongoDB object IDs to uniquely identify the data being requested by the caller.Check if you run itEPSS 0.26%Nov 14, 2025
- Low3.8A Server-side Request Forgery vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows Probing of internal infrastructuCheck if you run itEPSS 0.20%Nov 14, 2025
- Critical9.1IBM AIX 7.2, and 7.3 and IBM VIOS 3.1, and 4.1 NIM server (formerly known as NIM master) service (nimesis) could allow a remote attacker to traverse directories on the system.Check if you run itEPSS 0.53%Nov 13, 2025
Sort