Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical10.0Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .Check this weekEPSS 17.00%Oct 29, 2025
- Medium5.4A cross-site request forgery (CSRF) vulnerability in Jenkins Publish to Bitbucket Plugin 0.4 and earlier allows attackers to connect to an attacker-specified URL using attacker-speCheck if you run itEPSS 0.21%Oct 29, 2025
- Medium4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Task Runner Plugin 0.9.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specCheck if you run itEPSS 0.21%Oct 29, 2025
- Medium4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Start Windocks Containers Plugin 1.4 and earlier allows attackers to connect to an attacker-specified URL.Check if you run itEPSS 0.21%Oct 29, 2025
- Medium4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Themis Plugin 1.4.1 and earlier allows attackers to connect to an attacker-specified HTTP server.Check if you run itEPSS 0.23%Oct 29, 2025
- Medium5.4A cross-site request forgery (CSRF) vulnerability in Jenkins Extensible Choice Parameter Plugin 239.v5f5c278708cf and earlier allows attackers to execute sandboxed Groovy code.Check if you run itEPSS 0.26%Oct 29, 2025
- High7.5Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about the SAML authentication flow between a uCheck if you run itEPSS 0.47%Oct 29, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows Cross Site Request Forgery.This issue affects PremmercCheck if you run itEPSS 0.13%Oct 29, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Premmerce Premmerce premmerce allows Cross Site Request Forgery.This issue affects Premmerce: from n/a through <= 1.3.19.Check if you run itEPSS 0.13%Oct 29, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in WpEstate WP Rentals wprentals allows Cross Site Request Forgery.This issue affects WP Rentals: from n/a through <= 3.13.1.Check if you run itEPSS 0.13%Oct 29, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in colabrio Stockie Extra stockie-extra allows Cross Site Request Forgery.This issue affects Stockie Extra: from n/a through <= 1.2.Check if you run itEPSS 0.13%Oct 29, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a thrCheck if you run itEPSS 0.13%Oct 29, 2025
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in Allegro Marketing hpb seo plugin for WordPress hpbseo allows Reflected XSS.This issue affects hpb seo plugin for WordPress: fromCheck if you run itEPSS 0.13%Oct 29, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in highwarden Super Store Finder superstorefinder-wp allows Cross Site Request Forgery.This issue affects Super Store Finder: from nCheck if you run itEPSS 0.14%Oct 29, 2025
- Medium5.3Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 5.5.4.Check if you run itEPSS 0.14%Oct 29, 2025
- Medium5.0Insecure Direct Object Reference (IDOR) in /tenants/{id} API endpoint in Inforcer Platform version 2.0.153 allows an authenticated user with low privileges to enumerate and accessCheck this weekEPSS 22.00%Oct 29, 2025
- High8.8An issue in NCR Atleos Terminal Manager (ConfigApp) v3.4.0 allows attackers to escalate privileges via a crafted request.Check this weekEPSS 30.00%Oct 29, 2025
- High7.5Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication.Check this weekEPSS 34.00%Oct 29, 2025
- Medium5.8An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 allows a remote attacker to cause the server to issue HTTP reCheck if you run itEPSS 0.29%Oct 29, 2025
- Medium6.5SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.Check this weekEPSS 26.00%Oct 29, 2025
- High7.5Starlette is a lightweight ASGI framework/toolkit.Check this weekEPSS 80.00%Oct 28, 2025
- High7.2Astro is a web framework that includes an image proxy.Check this weekEPSS 35.00%Oct 28, 2025
- Medium5.1IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript codeCheck this weekEPSS 49.00%Oct 28, 2025
- Medium5.1IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript codeCheck this weekEPSS 49.00%Oct 28, 2025
- Medium5.1IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript codeCheck this weekEPSS 49.00%Oct 28, 2025
Sort