Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.4Moodle PDF Annotator plugin v1.5 release 9 allows stored cross-site scripting (XSS) via the Public Comments feature.Check if you run itEPSS 0.22%Oct 21, 2025
- Medium6.5LibreTime 3.0.0-alpha.10 and possibly earlier is vulnerable to Broken Access Control, where a user with the DJ role can access analytics data via the Web UI and direct API calls.Check if you run itEPSS 0.41%Oct 21, 2025
- High8.6A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directoryCheck this weekEPSS 10.89%Oct 21, 2025
- Medium6.1Bambu Studio 2.1.1.52 and earlier is affected by a vulnerability that allows arbitrary code execution during application startup.Check if you run itEPSS 0.16%Oct 21, 2025
- Medium5.1The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access to decrypt sensitive aCheck if you run itEPSS 0.13%Oct 21, 2025
- Medium5.1The Reolink Desktop Application 8.18.12 contains hardcoded credentials as the Initialization Vector (IV) in its AES-CFB encryption implementation allowing attackers with access toCheck if you run itEPSS 0.14%Oct 21, 2025
- Medium5.1Reolink desktop application 8.18.12 contains a vulnerability in its local authentication mechanism.Check if you run itEPSS 0.25%Oct 21, 2025
- Medium6.5Reolink desktop application 8.18.12 contains a command injection vulnerability in its scheduled cache-clearing mechanism via a crafted folder name.Check if you run itEPSS 1.22%Oct 21, 2025
- High8.8The administrator password setting of the D-Link DIR-820L 1.06B02 is has Improper Access Control and is vulnerable to Unverified Password Change via crafted POST request to /get_seCheck if you run itEPSS 0.54%Oct 21, 2025
- Medium5.0The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 8.2.5 via the wp_ajax_import_eleCheck if you run itEPSS 0.24%Oct 20, 2025
- Medium5.4Taguette is an open source qualitative research tool.Check if you run itEPSS 0.18%Oct 20, 2025
- High7.1Taguette is an open source qualitative research tool.Check if you run itEPSS 0.25%Oct 20, 2025
- Medium6.0Vite is a frontend tooling framework for JavaScript.Check if you run itEPSS 1.05%Oct 20, 2025
- Medium5.3External Control of File Name or Path vulnerability in opentext Flipper allows Path Traversal.Check if you run itEPSS 0.29%Oct 20, 2025
- Low2.3Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels.Check if you run itEPSS 0.28%Oct 20, 2025
- Medium5.3Path Traversal vulnerability in opentext Flipper allows Absolute Path Traversal.Check if you run itEPSS 0.39%Oct 20, 2025
- Low1.0Insufficient Granularity of Access Control vulnerability in opentext Flipper allows Exploiting Incorrectly Configured Access Control Security Levels.Check if you run itEPSS 0.26%Oct 20, 2025
- High8.8Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in The Wikimedia Foundation Mediawiki - LanguageSelector ExtensionCheck if you run itEPSS 0.35%Oct 20, 2025
- Medium6.1Heap-based Buffer Overflow vulnerability in ABB Terra AC wallbox (UL40/80A), ABB Terra AC wallbox (UL32A), ABB Terra AC wallbox (MID/ CE) -Terra AC MID, ABB Terra AC wallbox (MID/Check if you run itEPSS 0.28%Oct 20, 2025
- Medium6.5An authorized user may crash the MongoDB server by causing buffer over-read.Check if you run itEPSS 0.27%Oct 20, 2025
- Medium6.9Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - ExternalGuidance allows Stored XSSCheck if you run itEPSS 0.34%Oct 20, 2025
- High7.1Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Microchip Time Provider 4100 allows SQL Injection.This issue affects Time ProvCheck if you run itEPSS 0.38%Oct 20, 2025
- High8.9Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affeCheck if you run itEPSS 1.38%Oct 20, 2025
- High8.9Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Microchip Time Provider 4100 allows OS Command Injection.This issue affeCheck if you run itEPSS 1.38%Oct 20, 2025
- High8.1FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.Check if you run itEPSS 0.31%Oct 20, 2025
Sort