Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5TOTOLINK X18 V9.1.0cu.2053_B20230309 was discovered to contain a command injection vulnerability via the agentName parameter in the setEasyMeshAgentCfg function.Check if you run itEPSS 1.02%Oct 1, 2025
- High8.8A reflected cross-site scripted (XSS) vulnerability in Codazon Magento Themes v1.1.0.0 to v2.4.7 allows attackers to execute arbitrary Javascript in the context of a user's browserCheck if you run itEPSS 0.38%Oct 1, 2025
- Medium4.3IMPAQTR Aurora before 1.36 allows Insecure Direct Object Reference attacks against the users list, organization details, bookmarks, and notifications of an arbitrary organization.Check if you run itEPSS 0.22%Oct 1, 2025
- Medium6.5Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id.Check if you run itEPSS 0.21%Oct 1, 2025
- Medium5.3Kazaar 1.25.12 allows a JWT with none in the alg field.Check if you run itEPSS 0.32%Oct 1, 2025
- High8.8DigiSign DigiSigner ONE 1.0.4.60 allows DLL Hijacking.Check if you run itEPSS 0.58%Oct 1, 2025
- Medium6.1An authenticated cross-site scripting (XSS) vulnerability in the Administrative interface of Radware AlteonOS Web UI Management v33.0.4.50 allows attackers to execute arbitrary webCheck if you run itEPSS 0.21%Oct 1, 2025
- High8.8A stored cross-site scripting (XSS) in Kissflow Work Platform Kissflow Application Versions 7337 Account v2.0 to v4.2vallows attackers to execute arbitrary web scripts or HTML viaCheck if you run itEPSS 0.34%Oct 1, 2025
- Medium5.4A reflected cross-site scripting (XSS) vulnerability in the /admin/system/packages endpoint of Luci OpenWRT v18.06.2 allows attackers to execute arbitrary Javascript in the contextCheck if you run itEPSS 0.18%Oct 1, 2025
- Medium5.5Storage Performance Development Kit (SPDK) 25.05 is vulnerable to Buffer Overflow in the NVMe-oF target component in SPDK - lib/nvmf.Check if you run itEPSS 0.33%Oct 1, 2025
- High8.8Dolibarr ERP & CRM v21.0.1 were discovered to contain a remote code execution (RCE) vulnerability in the User module configuration via the computed field parameter.Check if you run itEPSS 0.50%Oct 1, 2025
- High8.8File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality.Check if you run itEPSS 0.52%Oct 1, 2025
- Medium4.6Cross Site Scripting (XSS) vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rendered by other users.Check if you run itEPSS 0.29%Oct 1, 2025
- High8.2In Frappe ERPNext 15.57.5, the function get_rfq_containing_supplier() at erpnext/buying/doctype/request_for_quotation/request_for_quotation.py is vulnerable to SQL Injection, whichCheck if you run itEPSS 0.33%Oct 1, 2025
- High8.2In Frappe ERPNext 15.57.5, the function get_stock_balance_for() at erpnext/stock/doctype/stock_reconciliation/stock_reconciliation.py is vulnerable to SQL Injection, which allows aCheck if you run itEPSS 0.34%Oct 1, 2025
- High8.2In Frappe ERPNext 15.57.5, the function get_blanket_orders() at erpnext/controllers/queries.py is vulnerable to SQL Injection, which allows an attacker can extract all informationCheck if you run itEPSS 0.33%Oct 1, 2025
- High8.2In Frappe ERPNext 15.57.5, the function get_material_requests_based_on_supplier() at erpnext/stock/doctype/material_request/material_request.py is vulnerable to SQL Injection, whicCheck if you run itEPSS 0.34%Oct 1, 2025
- High8.1A heap-use-after free in the PdfTokenizer::ReadDictionary function of podofo v0.10.0 to v0.10.5 allows attackers to cause a Denial of Service (DoS) by supplying a crafted PDF file.Check if you run itEPSS 0.40%Oct 1, 2025
- Low2.9Poppler 24.06.1 through 25.x before 25.04.0 allows stack consumption and a SIGSEGV via deeply nested structures within the metadata (such as GTS_PDFEVersion) of a PDF document, e.gCheck if you run itEPSS 0.13%Oct 1, 2025
- High8.8A CRLF injection vulnerability in Neto CMS v6.313.0 through v6.314.0 allows attackers to execute arbitrary code via supplying a crafted HTTP request.Check if you run itEPSS 0.44%Oct 1, 2025
- Medium6.5Cross Site Scripting vulnerability in Neto E-Commerce CMS v.6.313.0 through v.6.3115 allows a remote attacker to escalate privileges via the kw parameter.Check if you run itEPSS 0.34%Oct 1, 2025
- High8.7Keysight Ixia Vision has an issue with hardcoded cryptographic material which may allow an attacker to intercept or decrypt payloads sent to the device via API calls or user authenCheck if you run itEPSS 0.26%Sep 30, 2025
- Medium6.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes.Check if you run itEPSS 0.48%Sep 30, 2025
- Medium4.8Stored cross-site scripting (XSS) vulnerabilities in Web Content translation in Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 thCheck if you run itEPSS 0.22%Sep 30, 2025
- UnknownDO NOT USE THIS CVE RECORD.Open the advisorySep 30, 2025
Sort