Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.4A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN side, using attacker-inCheck if you run itEPSS 0.29%Dec 9, 2025
- Low1.1An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network access to the device, toCheck if you run itEPSS 1.15%Dec 9, 2025
- Medium5.0Denial of Service Vulnerability in NETGEAR C6220 and C6230 (DOCSIS® 3.0 Two-in-one Cable Modem + WiFi Router) allows authenticated local WiFi users reboot the router.Check if you run itEPSS 0.20%Dec 9, 2025
- Medium5.3Missing Authorization vulnerability in Essential Plugin Slider a SlidersPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider a SliCheck if you run itEPSS 0.30%Dec 9, 2025
- Medium4.3Missing Authorization vulnerability in Repute Infosystems ARMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ARMember: from n/a thrCheck if you run itEPSS 0.29%Dec 9, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Taylor Hawkes WP Fast Cache allows Cross Site Request Forgery.This issue affects WP Fast Cache: from n/a through 1.5.Check if you run itEPSS 0.13%Dec 9, 2025
- Medium5.4Missing Authorization vulnerability in Brainstorm Force Spectra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a throughCheck if you run itEPSS 0.25%Dec 9, 2025
- High7.8Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attackeCheck if you run itEPSS 0.58%Dec 9, 2025
- High7.1Path traversal in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote authenticated attacker to write arbitrary files outside of the intended directory.Check if you run itEPSS 1.36%Dec 9, 2025
- High8.8Improper control of dynamically managed code resources in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote, unauthenticated attacker to write arbitrary files oCheck if you run itEPSS 1.96%Dec 9, 2025
- Medium4.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educar allows Stored Cross-Site Scripting (XSS) via the matriculaCheck if you run itEPSS 0.21%Dec 9, 2025
- High7.3Uncontrolled Search Path Element vulnerability in Yandex Messenger on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.245Check if you run itEPSS 0.17%Dec 9, 2025
- Critical9.6Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator sessCheck this weekEPSS 33.50%Dec 9, 2025
- High7.3Uncontrolled Search Path Element vulnerability in Yandex Telemost on MacOS allows Search Order Hijacking.This issue affects Telemost: before 2.19.1.Check if you run itEPSS 0.18%Dec 9, 2025
- High7.3Uncontrolled Search Path Element vulnerability in Yandex Disk on MacOS allows Search Order Hijacking.This issue affects Disk: before 3.2.45.3275.Check if you run itEPSS 0.18%Dec 9, 2025
- Medium5.4The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcodeCheck if you run itEPSS 0.48%Dec 9, 2025
- Medium5.4Cross-Site Request Forgery (CSRF) vulnerability in StellarWP GiveWP give allows Cross Site Request Forgery.This issue affects GiveWP: from n/a through <= 4.13.1.Check if you run itEPSS 0.13%Dec 9, 2025
- Medium6.5givewp givewp Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 0.30%Dec 9, 2025
- High8.4EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access.Check if you run itEPSS 0.77%Dec 9, 2025
- Low2.3A post-authentication flaw in the network two-phase commit protocol used for cross-shard transactions in MongoDB Server may lead to logical data inconsistencies under specific condCheck if you run itEPSS 0.22%Dec 9, 2025
- Medium5.8EDK2 contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access.Check if you run itEPSS 0.14%Dec 9, 2025
- Medium4.3Missing Authorization vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This iCheck if you run itEPSS 0.26%Dec 9, 2025
- High7.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 Elements dt-the7-core allows PHP Local FilCheck if you run itEPSS 0.46%Dec 9, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in muffingroup Betheme betheme allows DOM-Based XSS.This issue affects Betheme: fCheck if you run itEPSS 0.20%Dec 9, 2025
- High7.5Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dream-Theme The7 dt-the7 allows PHP Local File Inclusion.ThCheck if you run itEPSS 0.46%Dec 9, 2025
Sort