Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low3.1Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team membCheck if you run itEPSS 0.33%Oct 16, 2025
- High8.1Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which aCheck if you run itEPSS 0.34%Oct 16, 2025
- Low3.1Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles toCheck if you run itEPSS 0.27%Oct 16, 2025
- Medium5.1Stored Cross-Site Scripting (XSS) in Sergestec's Exito v8.0, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'obs' pCheck if you run itEPSS 0.27%Oct 16, 2025
- High7.1Insecure direct object reference (IDOR) vulnerability in Sergestec's Exito v8.0.Check if you run itEPSS 0.34%Oct 16, 2025
- Critical9.3SQL injection in Sergestec's SISTICK v7.2.Check if you run itEPSS 0.38%Oct 16, 2025
- Medium6.9In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ip_packet_receive() function when receiCheck if you run itEPSS 0.37%Oct 16, 2025
- Critical9.3SQL injection in Sergestec's Exito v8.0.Check if you run itEPSS 0.46%Oct 16, 2025
- High7.5Whale browser before 4.33.325.17 allows an attacker to bypass the Content Security Policy via a specific scheme in a dual-tab environment.Check if you run itEPSS 0.37%Oct 16, 2025
- High7.5Whale browser before 4.33.325.17 allows an attacker to bypass the Same-Origin Policy in a dual-tab environment.Check if you run itEPSS 0.21%Oct 16, 2025
- Critical9.8Whale Browser before 4.33.325.17 allows an attacker to escape the iframe sandbox in a dual-tab environment.Check if you run itEPSS 0.50%Oct 16, 2025
- Critical9.8The Felan Framework plugin for WordPress is vulnerable to improper authentication in versions up to, and including, 1.1.4.Check if you run itEPSS 0.61%Oct 16, 2025
- Medium5.3The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_plugin_actions' function called via anCheck if you run itEPSS 0.32%Oct 16, 2025
- Critical9.8The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6.Check if you run itEPSS 0.54%Oct 16, 2025
- High8.8The Classified Pro theme for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'cwp_addons_update_plugin_cb' function in all versCheck if you run itEPSS 0.64%Oct 16, 2025
- Medium6.9In NetX Duo before 6.4.4, the networking support module for Eclipse Foundation ThreadX, there was a potential out of bound read issue in _nx_ipv4_packet_receive() function when recCheck if you run itEPSS 0.37%Oct 16, 2025
- Critical9.2In FileX before 6.4.2, the file support module for Eclipse Foundation ThreadX, there was a possible buffer overflow in the FileX RAM disk driver.Check if you run itEPSS 0.51%Oct 16, 2025
- Medium6.9In NetX Duo version before 6.4.4, the component of Eclipse Foundation ThreadX, there was an incorrect bound check in_nx_secure_tls_proc_clienthello_supported_versions_extension() iCheck if you run itEPSS 0.33%Oct 16, 2025
- High8.6Multiple versions of RG-EST300 provided by Ruijie Networks provide SSH server functionality.Check if you run itEPSS 0.60%Oct 16, 2025
- Medium5.3HCL BigFix Mobile 3.3 and earlier is affected by improper access control.Check if you run itEPSS 0.26%Oct 16, 2025
- Medium5.3HCL BigFix Modern Client Management (MCM) 3.3 and earlier is affected by improper access control.Check if you run itEPSS 0.26%Oct 16, 2025
- Medium6.4The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 3.21.1 (exclusive) due to insufficient input sanitization aCheck if you run itEPSS 0.29%Oct 16, 2025
- Medium4.3The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0.Check if you run itEPSS 0.20%Oct 16, 2025
- Medium6.5YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leadsCheck if you run itEPSS 0.31%Oct 16, 2025
- Medium5.5A divide-by-zero in VirtIO network device emulation in BitVisor from commit 108df6 (2020-05-20) to commit 480907 (2025-07-06) allows local attackers to cause a denial of service (hCheck if you run itEPSS 0.15%Oct 16, 2025
Sort