Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1Insecure Direct Object Reference (IDOR) vulnerability in TelegAI (telegai.com) thru 2025-05-26 in its chat component.Check if you run itEPSS 0.27%Jul 22, 2025
- Medium6.1Stored Cross-Site Scripting (XSS) in TelegAI (telegai.com) 2025-05-26 in its chat component and character container component.Check if you run itEPSS 0.34%Jul 22, 2025
- Medium6.5Stored Cross-Site Scripting (XSS) vulnerability in Chaindesk thru 2025-05-26 in its agent chat component.Check if you run itEPSS 0.52%Jul 22, 2025
- Medium6.1Self Cross-Site Scripting (XSS) vulnerability in ChatPlayground.ai through 2025-05-24, allows attackers to execute arbitrary code and gain sensitive information via a crafted SVG fCheck if you run itEPSS 0.34%Jul 22, 2025
- High8.8letta letta Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 2.11%Jul 22, 2025
- Medium6.6Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supplying path traversalCheck if you run itEPSS 0.62%Jul 22, 2025
- High8.8Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted external_data.locatioCheck if you run itEPSS 0.68%Jul 22, 2025
- Medium5.4Authorization bypass in update_user_group in onyx-dot-app Onyx Enterprise Edition 0.27.0 allows remote authenticated attackers to modify arbitrary user groups via crafted PATCH reqCheck if you run itEPSS 0.33%Jul 22, 2025
- Medium5.0Arbitrary File Overwrite (AFO) in superagi.controllers.resources.upload in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to overwrite arbitrary files via unsanitised fCheck if you run itEPSS 0.80%Jul 22, 2025
- Medium6.5Code Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious values in agent templCheck if you run itEPSS 0.46%Jul 22, 2025
- High8.8Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reportCheck if you run itEPSS 0.71%Jul 22, 2025
- High7.0Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the run_Check if you run itEPSS 0.53%Jul 22, 2025
- Medium6.1Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in RAGFlow 0.17.2 allows remote attackers to execute arbitrary JavaScript via crafted input to theCheck if you run itEPSS 0.33%Jul 22, 2025
- Medium6.5File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a malicious plugin ZIP file uplCheck if you run itEPSS 0.40%Jul 22, 2025
- Medium6.5SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary SQL statements via crafted input passed to the /v1/editor/sqlCheck if you run itEPSS 0.37%Jul 22, 2025
- Unknowncedargate ez-net_portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 1.03%Jul 22, 2025
- UnknownVM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not overrideCheck if you run itEPSS 0.38%Jul 21, 2025
- Medium4.3HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform.Check if you run itEPSS 0.32%Jul 21, 2025
- High7.2HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend.Check if you run itEPSS 0.23%Jul 21, 2025
- Critical9.3HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance.Check if you run itEPSS 0.46%Jul 21, 2025
- Medium5.3A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0.Check if you run itEPSS 0.47%Jul 21, 2025
- High7.6Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI.Check if you run itEPSS 0.28%Jul 21, 2025
- Critical9.4RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface.Check if you run itEPSS 0.76%Jul 21, 2025
- Medium5.3Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python.Check if you run itEPSS 0.66%Jul 21, 2025
- High7.8IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability.Check if you run itEPSS 0.27%Jul 21, 2025
Sort