Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- None0.0In the Linux kernel, the following vulnerability has been resolved: usb: storage: sddr55: Reject out-of-bound new_pba Discovered by Atuin - Automated Vulnerability Discovery EngineCheck if you run itEPSS 0.20%Dec 12, 2025
- Medium6.9A weakness has been identified in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0.Check if you run itEPSS 0.77%Dec 12, 2025
- High8.5BuhoNTFS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects BuhoNTFS: 1.3.2.Check if you run itEPSS 0.21%Dec 12, 2025
- Medium6.9A security flaw has been discovered in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464.Check if you run itEPSS 0.41%Dec 12, 2025
- Medium6.9A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464.Check if you run itEPSS 0.39%Dec 12, 2025
- Medium6.9Code Injection using Electron Fuses in waveterm on MacOS allows TCC Bypass.Check if you run itEPSS 0.21%Dec 12, 2025
- Medium5.9When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm).Check if you run itEPSS 0.26%Dec 12, 2025
- Medium5.3In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists.Check if you run itEPSS 0.48%Dec 12, 2025
- High7.5Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive data, including JWT tokens, may have riskeCheck if you run itEPSS 0.24%Dec 12, 2025
- Medium4.8SolarEdge monitoring platform contains a Cross‑Site Scripting (XSS) flaw that allows an authenticated user to inject payloads into report names, which may execute in a victim’s broCheck if you run itEPSS 0.17%Dec 12, 2025
- Low2.4SolarEdge SE3680H has unauthenticated disclosure of sensitive information during the bootloader loop.Check if you run itEPSS 0.16%Dec 12, 2025
- High8.6SolarEdge SE3680H has an exposed debug/test interface accessible to unauthenticated actors, allowing disclosure of system internals and execution of debug commands.Check if you run itEPSS 0.22%Dec 12, 2025
- High8.6SolarEdge SE3680H ships with an outdated Linux kernel containing unpatched vulnerabilities in core subsystems.Check if you run itEPSS 0.23%Dec 12, 2025
- High7.2APTIOV contains a vulnerability in BIOS where a user may cause “Improper Handling of Insufficient Permissions or Privileges” by local access.Check if you run itEPSS 0.12%Dec 12, 2025
- Low2.4The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under normal operating conditions.Check if you run itEPSS 0.17%Dec 12, 2025
- Medium5.5Apple Multiple Products Classic Buffer Overflow VulnerabilityPatch nowKEVEPSS 0.43%Dec 12, 2025
- High7.8Apple Multiple Products Improper Locking VulnerabilityPatch nowKEVEPSS 0.36%Dec 12, 2025
- High8.8Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc.Check if you run itEPSS 0.41%Dec 12, 2025
- Medium6.4The AI Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aife_post_meta' shortcode in all versions up to, and including, 1.0.22 due to insufficient iCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium4.3The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.2.2.Check if you run itEPSS 0.12%Dec 12, 2025
- Medium6.4The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpac_title_tag' parameter in the Magical Posts Accordion widget in all versionsCheck if you run itEPSS 0.22%Dec 12, 2025
- Medium5.3The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 7.2.2.2 via the 'get_loCheck if you run itEPSS 0.33%Dec 12, 2025
- Medium5.3The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV files in a publicly accesCheck if you run itEPSS 0.32%Dec 12, 2025
- Medium4.3The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.9.2.Check if you run itEPSS 0.16%Dec 12, 2025
- Medium4.3The Simple Bike Rental plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'simpbire_carica_prenotazioni' AJAX action in allCheck if you run itEPSS 0.24%Dec 12, 2025
Sort