Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method.Check if you run itEPSS 0.39%Aug 18, 2026
- High8.6grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages w…Check if you run itEPSS 0.41%Aug 18, 2026
- Critical9.3Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-han…Check if you run itEPSS 0.39%Aug 18, 2026
- Critical9.3Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a…Check if you run itEPSS 0.86%Aug 18, 2026
- Medium5.1Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates.Check if you run itEPSS 0.24%Aug 18, 2026
- Medium5.1Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml fi…Check if you run itEPSS 0.26%Aug 18, 2026
- High8.2Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation.Check if you run itEPSS 0.43%Aug 18, 2026
- High8.7SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list inst…Check if you run itEPSS 0.38%Aug 18, 2026
- Medium6.9SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce S…Check if you run itEPSS 0.39%Aug 18, 2026
- Medium5.3SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instea…Check if you run itEPSS 0.25%Aug 18, 2026
- Critical9.3SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML vi…Check if you run itEPSS 0.20%Aug 18, 2026
- Critical9.3Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing…Check if you run itEPSS 0.84%Aug 18, 2026
- Critical9.3SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata.Check if you run itEPSS 0.33%Aug 18, 2026
- Medium5.5A weakness has been identified in PHPGurukul Complaint Management System 1.0.Check if you run itEPSS 0.43%Aug 18, 2026
- Low2.1A flaw has been found in Webkul Bagisto up to 2.4.4.Check if you run itEPSS 0.45%Aug 18, 2026
- Low2.1A vulnerability was detected in Webkul Bagisto up to 2.4.4.Check if you run itEPSS 0.37%Aug 18, 2026
- Medium5.5A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0.Check if you run itEPSS 0.43%Aug 18, 2026
- Low2.1A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0.Check if you run itEPSS 0.47%Aug 17, 2026
- Critical9.6Onyx is an open-source AI platform.Check if you run itEPSS 0.49%Aug 17, 2026
- Critical9.3MLflow Server-Side Request Forgery VulnerabilityPatch nowKEVEPSS 10.02%Aug 17, 2026
- UnknownZero-length DATAGRAM frames bypass the receive buffer limit in quinn-protoOpen the advisoryAug 17, 2026
- Critical9.1GitLab GitLab Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 60.20%Aug 17, 2026
- High7.5Duplicate Advisory: SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event stream,Open the advisoryAug 16, 2026
- High8.7SiYuan: A parser differential between the WebSocket keepalive exemption and the session quarantine allows unauthenticated access to the broadcast event streamCheck if you run itEPSS 0.54%Aug 15, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: btrfs: skip global block reserve accounting for rescue mounts [BUG] Mounting with rescue=ibadroots…Check if you run itEPSS 0.21%Aug 15, 2026
Sort