Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownApache Solr Improper AuthenticationPatch nowKEVEPSS 92.75%Oct 31, 2025
- Medium5.1Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting (XSS) and cross-site request forgery (CSRF) via the Hypermap Replay component.Check if you run itEPSS 0.32%Oct 30, 2025
- High8.7Nagios XI versions prior to 5.7.2 allow PHP files to be uploaded to the Audio Import directory and executed from that location.Check if you run itEPSS 1.38%Oct 30, 2025
- Medium6.9Nagios XI versions prior to 5.6.11 contain unauthenticated vulnerabilities in the Highcharts local exporting tool.Check if you run itEPSS 0.63%Oct 30, 2025
- Critical9.4Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution (RCE) through its NRDP (Nagios Remote Data Processor) server plugins.Check if you run itEPSS 2.30%Oct 30, 2025
- High8.7Nagios Log Server versions prior to 2024R2.0.2 contain a vulnerability in the cluster manager component when requesting sensitive credentials from peer nodes over an unencrypted chCheck if you run itEPSS 0.74%Oct 30, 2025
- High8.6IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system.Check this weekEPSS 42.00%Oct 30, 2025
- High7.5IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 21 could allow a remote attacker to traverse directories on the system.Check this weekEPSS 53.00%Oct 30, 2025
- Critical9.6JumpServer is an open source bastion host and an operation and maintenance security audit system.Check this weekEPSS 50.00%Oct 30, 2025
- Medium5.1Quick.Cart is vulnerable to Cross-Site Request Forgery in product creation functionality.Check this weekEPSS 21.00%Oct 30, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_rndis: Refactor bind path to use __free() After an bind/unbind cycle, the rndis->notify_req is leCheck if you run itEPSS 0.15%Oct 30, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_acm: Refactor bind path to use __free() After an bind/unbind cycle, the acm->notify_req is left sCheck if you run itEPSS 0.15%Oct 30, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ecm: Refactor bind path to use __free() After an bind/unbind cycle, the ecm->notify_req is left sCheck if you run itEPSS 0.15%Oct 30, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_ncm: Refactor bind path to use __free() After an bind/unbind cycle, the ncm->notify_req is left sCheck if you run itEPSS 0.15%Oct 30, 2025
- High7.5Incorrect access control in the Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allows attackers to arbitrarily change the admiCheck this weekEPSS 33.00%Oct 30, 2025
- High8.2A path traversal vulnerability was identified in SourceCodester Pet Grooming Management System 1.0, affecting the admin/manage_website.php component.Check this weekEPSS 52.00%Oct 30, 2025
- High7.5Kanova Android App version 1.0.27 (package name com.karelane), developed by Karely L.L.C., contains improper access control vulnerabilities.Check this weekEPSS 30.00%Oct 30, 2025
- High7.5TalkTalk 3.3.6 Android App contains improper access control vulnerabilities in multiple API endpoints.Check this weekEPSS 30.00%Oct 30, 2025
- Medium6.5PerfreeBlog v4.0.11 is vulnerable to Server-Side Request Forgery due to a missing authorization check in the uploadAttachByUrl API endpoint (AttachController.java).Check this weekEPSS 26.00%Oct 30, 2025
- Critical9.3kubernetes operations Missing Authentication for Critical FunctionPatch nowKEVEPSS 0.40%Oct 30, 2025
- Medium6.5Cross-Site Request Forgery (CSRF) vulnerability in Drupal Currency allows Cross Site Request Forgery.This issue affects Currency: from 0.0.0 before 3.5.0.Check this weekEPSS 13.00%Oct 29, 2025
- Medium6.9Prior to September 19, 2025, the Hospital Manager Backend Services returned verbose ASP.NET error pages for invalid WebResource.axd requests, disclosing framework and ASP.NET versiCheck this weekEPSS 27.00%Oct 29, 2025
- High8.7Prior to September 19, 2025, the Hospital Manager Backend Services exposed the ASP.NET tracing endpoint /trace.axd without authentication, allowing a remote attacker to obtain liveCheck this weekEPSS 42.00%Oct 29, 2025
- High8.1Zitadel is open-source identity infrastructure software.Check this weekEPSS 36.00%Oct 29, 2025
- High8.6FluxCP is a web-based Control Panel for rAthena servers written in PHP.Check this weekEPSS 24.00%Oct 29, 2025
Sort