Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allowsCheck if you run itEPSS 0.37%Jul 18, 2025
- Medium4.0An improper access control vulnerability [CWE-284] in FortiIsolator version 2.4.4, version 2.4.3, 2.3 all versions logging component may allow a remote authenticated read-only attaCheck if you run itEPSS 0.39%Jul 18, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decreCheck if you run itEPSS 0.18%Jul 18, 2025
- Medium4.2An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.Check this weekEPSS 70.14%Jul 18, 2025
- High7.6An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks.Check this weekEPSS 57.74%Jul 18, 2025
- Critical9.8A SQL injection in Articles Calendar extension 1.0.0 - 1.0.1.0007 for Joomla allows attackers to execute arbitrary SQL commands.Check if you run itEPSS 0.45%Jul 18, 2025
- Critical9.8A SQL injection in Articles Good Search extension 1.0.0 - 1.2.4.0011 for Joomla allows attackers to execute arbitrary SQL commands.Check if you run itEPSS 0.45%Jul 18, 2025
- Medium5.3The Listly: Listicles For WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Init() function in all versionsCheck if you run itEPSS 0.32%Jul 18, 2025
- Medium6.4The Testimonial Post type plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play’ parameter in all versions up to, and including, 1.2.1 due to insuffiCheck if you run itEPSS 0.27%Jul 18, 2025
- Medium6.4The Vertical scroll image slideshow gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and including, 11.1 dCheck if you run itEPSS 0.27%Jul 18, 2025
- Medium4.3The Copymatic – AI Content Writer & Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.Check if you run itEPSS 0.14%Jul 18, 2025
- Medium6.1The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0.Check if you run itEPSS 0.13%Jul 18, 2025
- High8.8The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the auto_login() function in versions 1.0 to 1.1.Check if you run itEPSS 0.44%Jul 18, 2025
- Medium6.4The Ruven Themes: Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ruven_button' shortcode in all versions up to, and including, 1.0 dCheck if you run itEPSS 0.21%Jul 18, 2025
- Medium5.1A vulnerability, which was classified as problematic, has been found in PHPGurukul Art Gallery Management System 1.1.Check if you run itEPSS 0.31%Jul 18, 2025
- Medium4.0qBittorrent before 5.1.2 does not prevent access to a local file that is referenced in a link URL.Check if you run itEPSS 0.47%Jul 18, 2025
- Critical9.8CrushFTP Unprotected Alternate Channel VulnerabilityPatch nowKEVEPSS 93.47%Jul 18, 2025
- UnknownMicrosoft SharePoint Improper AuthenticationPatch nowKEVEPSS 99.89%Jul 18, 2025
- Critical9.8Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 100.00%Jul 18, 2025
- Medium6.5An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint.Check if you run itEPSS 1.12%Jul 18, 2025
- Medium6.5An arbitrary file upload vulnerability in the component /rsc/filemanager.rsc.class.php of Filemanager commit c75b914 v.2.5.0 allows attackers to execute arbitrary code via uploadinCheck if you run itEPSS 0.54%Jul 18, 2025
- UnknownAuthentication Bypass Using an Alternate Path or ChannelPatch nowKEVEPSS 3.65%Jul 18, 2025
- UnknownMissing AuthorizationPatch nowKEVEPSS 2.15%Jul 18, 2025
- UnknownCitrix virtual_apps_and_desktops Improper Control of Dynamically-Managed Code ResourcesPatch nowKEVEPSS 46.89%Jul 18, 2025
- High8.7Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in URL parameters, which wouCheck if you run itEPSS 0.38%Jul 17, 2025
Sort