Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.6Multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page in Liferay Portal 7.4.3.35 through 7.4.3.111, and Liferay DXP 2023.Q4.0 throughCheck if you run itEPSS 0.23%Oct 31, 2025
- Medium5.1Reflected cross-site scripting (XSS) vulnerability in Languauge Override in Liferay Portal 7.4.3.8 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 througCheck if you run itEPSS 0.24%Oct 31, 2025
- Medium4.8Authentication bypass by spoofing in Microsoft Configuration Manager allows an authorized attacker to perform spoofing over an adjacent network.Check if you run itEPSS 3.26%Oct 31, 2025
- Low1.8If the value passed to os.path.expandvars() is user-controlled a performance degradation is possible when expanding environment variables.Check if you run itEPSS 0.15%Oct 31, 2025
- Medium6.9Missing Security Headers.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.Check if you run itEPSS 0.37%Oct 31, 2025
- High8.4On a client with an admin user, a Global_Shipping script can be implemented.Check if you run itEPSS 0.29%Oct 31, 2025
- High8.4When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted.Check if you run itEPSS 0.20%Oct 31, 2025
- High8.8The service Bizerba Communication Server (BCS) has an unquoted service path.Check if you run itEPSS 0.14%Oct 31, 2025
- Critical10.0Email Server Certificate Verification Disabled.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.Check if you run itEPSS 0.22%Oct 31, 2025
- Medium6.9Insufficient Password Policy.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.Check if you run itEPSS 0.34%Oct 31, 2025
- Medium5.3By manipulating the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements, an attacker can stage a man-in-the-middle attack between an electric vehiclCheck if you run itEPSS 0.79%Oct 31, 2025
- High7.1Agno is a multi-agent framework, runtime and control plane.Check if you run itEPSS 0.16%Oct 31, 2025
- Critical9.2The equipment initially can be configured using the manufacturer's application, by Wi-Fi, by the web server or with the manufacturer’s software.Check if you run itEPSS 0.40%Oct 31, 2025
- High8.3The web server of the device performs exchanges of sensitive information in clear text through an insecure protocol.Check if you run itEPSS 0.25%Oct 31, 2025
- Critical9.2Denial of service of the web server through specific requests to this protocolCheck if you run itEPSS 0.37%Oct 31, 2025
- Medium5.1The web application is vulnerable to a so-called ‘clickjacking’ attack.Check if you run itEPSS 0.39%Oct 31, 2025
- High7.5Integer overflow in GameMaker IDE below 2024.14.0 version can lead to can lead to application crashes through denial-of-service attacks (DoS).Check if you run itEPSS 0.49%Oct 31, 2025
- Medium5.3An XSS issue was discovered in Afterlogic Aurora webmail version 9.8.3 and below.Check if you run itEPSS 0.44%Oct 31, 2025
- Medium5.3The Analytify Pro plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.0.3 via the Analytify Tag HTML details.Check if you run itEPSS 0.27%Oct 31, 2025
- High7.7The equipment grants a JWT token for each connection in the timeline, but during an active valid session, a hijacking of the token can be done.Check if you run itEPSS 0.35%Oct 31, 2025
- Low3.7IBM Jazz for Service Management 1.1.3.0 through 1.1.3.25 does not set the secure attribute on authorization tokens or session cookies.Check if you run itEPSS 0.16%Oct 31, 2025
- High7.8IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow a non-root user to gain higher privileges/capabilities within the scope of a container due to execution withCheck if you run itEPSS 0.14%Oct 31, 2025
- Medium5.1Nagios XI versions prior to < 2024R1.1 is vulnerable to a cross-site scripting (XSS) when a user visits the "missing page" (404) page after following a link from another website.Check if you run itEPSS 0.59%Oct 31, 2025
- Medium6.8Tampering of the registry entries might have led to preventing the ESET security products from starting correctly on the next system startup or to unauthorized changes in the produCheck if you run itEPSS 0.14%Oct 31, 2025
- High7.5When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have.Check if you run itEPSS 0.43%Oct 31, 2025
Sort