Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3A flaw in the cohort search web service allowed users with permissions in lower contexts to access cohort information from the system context, revealing restricted administrative dCheck if you run itEPSS 0.25%Oct 23, 2025
- Medium4.3Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups.Check if you run itEPSS 0.27%Oct 23, 2025
- High7.5Moodle’s mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.Check if you run itEPSS 0.40%Oct 23, 2025
- Medium5.4A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.Check if you run itEPSS 0.25%Oct 23, 2025
- Medium5.3The router’s inconsistent response to invalid course IDs allowed attackers to infer which course IDs exist, potentially aiding reconnaissance.Check if you run itEPSS 0.28%Oct 23, 2025
- Medium5.3An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.Check if you run itEPSS 0.30%Oct 23, 2025
- Medium4.3Moodle failed to verify enrolment status correctly when sending quiz notifications.Check if you run itEPSS 0.23%Oct 23, 2025
- Medium4.3A flaw was found in the course overview output function where user access permissions were not fully enforced.Check if you run itEPSS 0.24%Oct 23, 2025
- Medium5.1Open redirection vulnerability in MOLGENIS EMX2 v11.14.0.Check if you run itEPSS 0.30%Oct 23, 2025
- High7.1Path Traversal vulnerability in version 4.4.2236.1 of TESI Gandia Integra Total.Check if you run itEPSS 0.38%Oct 23, 2025
- Medium5.1Stored Cross-Site Scripting (XSS) vulnerability in Energy CRM v2025 by Status Tracker Ltd, consisting of a stored XSS due to lack of proper validation of user input by sending a POCheck if you run itEPSS 0.21%Oct 23, 2025
- Medium4.8QuickCMS is vulnerable to multiple Stored XSS in slider editor functionality (sliders-form).Check if you run itEPSS 0.19%Oct 23, 2025
- Medium4.8QuickCMS is vulnerable to multiple Stored XSS in page editor functionality (pages-form).Check if you run itEPSS 0.19%Oct 23, 2025
- High7.5A flaw was found in the asynchronous message queue handling of the libsoup library, widely used by GNOME and WebKit-based applications to manage HTTP/2 communications.Check if you run itEPSS 0.46%Oct 23, 2025
- High7.6Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Proliz Software Ltd.Check if you run itEPSS 0.26%Oct 23, 2025
- Medium5.4Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ArkSigner Software and Hardware Inc.Check if you run itEPSS 0.22%Oct 23, 2025
- High8.4Multiple NAS management applications provided by I-O DATA DEVICE, INC.Check if you run itEPSS 0.20%Oct 23, 2025
- Medium5.1GROWI v4.2.7 and earlier contains a cross-site scripting vulnerability in the page alert function.Check if you run itEPSS 0.20%Oct 23, 2025
- Medium4.6Movable Type contains a stored cross-site scripting vulnerability in Edit CategorySet of ContentType page.Check if you run itEPSS 0.23%Oct 23, 2025
- Medium4.6Movable Type contains a stored cross-site scripting vulnerability in Edit ContentData page.Check if you run itEPSS 0.23%Oct 23, 2025
- Critical10.0Outdated and Vulnerable UI Dependencies might potentially lead to exploitation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5.Check if you run itEPSS 0.41%Oct 23, 2025
- Medium5.5Uncaught Exception (CWE-248) in the Command Centre Server allows an Authorized and Privileged Operator to crash the Command Centre Server at will.Check if you run itEPSS 0.13%Oct 23, 2025
- Medium6.7Cleartext Storage of Sensitive Information (CWE-312) in the Gallagher Morpho integration could allow an authenticated user with access to the Command Centre Server to export a specCheck if you run itEPSS 0.10%Oct 23, 2025
- Critical9.9Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497) in the Gallagher Morpho integration could allow an authenticated operator with limited site perCheck if you run itEPSS 0.34%Oct 23, 2025
- Medium5.5Client-Side Enforcement of Server-Side Security (CWE-602) in the Command Centre Server allows a privileged operator to enter invalid competency data, bypassing expiry checks.Check if you run itEPSS 0.14%Oct 23, 2025
Sort