Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.1A vulnerability was identified in CodeAstro Real Estate Management System 1.0.Check if you run itEPSS 0.36%Dec 18, 2025
- High8.3Improper neutralization of input during web page generation ('cross-site scripting') in Azure Cosmos DB allows an unauthorized attacker to perform spoofing over a network.Check if you run itEPSS 0.71%Dec 18, 2025
- Critical9.1Weblate is a web based localization tool.Check if you run itEPSS 0.79%Dec 18, 2025
- High7.7Weblate is a web based localization tool.Check if you run itEPSS 0.41%Dec 18, 2025
- Medium4.3Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to bypass intended permission restrictions via a crafted HCheck if you run itEPSS 0.23%Dec 18, 2025
- Medium4.3Improper Authorization (CWE-285) in Kibana can lead to privilege escalation (CAPEC-233) by allowing an authenticated user to change a document's sharing type to "global," even thouCheck if you run itEPSS 0.19%Dec 18, 2025
- Medium4.9Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow an authenticated user with snapshot restore privileges to cause Excessive Allocation (CAPECheck if you run itEPSS 0.38%Dec 18, 2025
- Medium6.5Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) of computing resourCheck if you run itEPSS 0.31%Dec 18, 2025
- Medium6.1Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an unauthenticated user to embed a malicious script in content that will be serCheck if you run itEPSS 0.22%Dec 18, 2025
- High7.2Improper neutralization of input during web page generation ('Cross-site Scripting') (CWE-79) allows an authenticated user to embed a malicious script in content that will be serveCheck if you run itEPSS 0.25%Dec 18, 2025
- Medium6.5Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CAPEC-130) causing a peCheck if you run itEPSS 0.32%Dec 18, 2025
- High8.2Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized attacker to perform spoofing over a netwCheck if you run itEPSS 0.49%Dec 18, 2025
- High7.2'.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network.Check if you run itEPSS 1.01%Dec 18, 2025
- Critical10.0Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.Check if you run itEPSS 0.77%Dec 18, 2025
- Critical10.0Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network.Check if you run itEPSS 0.97%Dec 18, 2025
- Critical9.9Custom Question Answering Elevation of Privilege VulnerabilityCheck if you run itEPSS 0.71%Dec 18, 2025
- Low3.1Microsoft Edge (Chromium-based) Spoofing VulnerabilityCheck if you run itEPSS 0.28%Dec 18, 2025
- Medium6.5Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to trigger a Buffer OveCheck if you run itEPSS 0.19%Dec 18, 2025
- Medium6.9An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact with restricted chat agents, gaining access to the agents'Check if you run itEPSS 0.47%Dec 18, 2025
- Medium6.5Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the NFS protocol dissector, leading to a denial-of-service (DoS)Check if you run itEPSS 0.25%Dec 18, 2025
- Medium6.5Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the application or cause signiCheck if you run itEPSS 0.46%Dec 18, 2025
- Medium5.3Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory and CPU via the integraCheck if you run itEPSS 0.41%Dec 18, 2025
- High8.7Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a combination of path traversal and server-side request forgery (SSRF) vulnerabilities in that allow an aCheck if you run itEPSS 5.44%Dec 18, 2025
- Medium6.9Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the sc_device_msg_deserialize() function.Check if you run itEPSS 0.42%Dec 18, 2025
- High7.5Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with each other.Check if you run itEPSS 0.28%Dec 18, 2025
Sort