Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.2An out-of-bounds write in VirtIO network device emulation in BitVisor from commit 108df6 (2020-05-20) to commit 480907 (2025-07-06) allows local attackers to cause a denial of servCheck if you run itEPSS 0.21%Oct 16, 2025
- High7.1A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2.Check if you run itEPSS 0.31%Oct 16, 2025
- High7.1Webmin 2.510 is vulnerable to a Host Header Injection in the password reset functionality (forgot_send.cgi).Check if you run itEPSS 0.46%Oct 16, 2025
- Medium6.5SQL injection vulnerability in Ultimate PHP Board 2.2.7 via the username field in lostpassword.php.Check if you run itEPSS 0.29%Oct 16, 2025
- Medium6.1Cross site scripting (XSS) vulnerability in Ultimate PHP Board 2.2.7 via the u_name parameter in lostpassword.php.Check if you run itEPSS 0.27%Oct 16, 2025
- High8.2FelixRiddle dev-jobs-handlebars 1.0 uses absolute password-reset (magic) links using the untrusted header and forces the scheme.Check if you run itEPSS 0.43%Oct 16, 2025
- Medium6.5An arbitrary file upload vulnerability in SageMath, Inc CoCalc before commit 0d2ff58 allows attackers to execute arbitrary code via uploading a crafted SVG file.Check if you run itEPSS 0.41%Oct 16, 2025
- Medium6.5A hard-coded weak password vulnerability has been discovered in all Magic-branded devices from Chinese network equipment manufacturer H3C.Check if you run itEPSS 0.28%Oct 16, 2025
- Medium6.5The file mexcel.php in the Vfront 0.99.52 codebase contains a vulnerable call to unserialize(base64_decode($_POST['mexcel'])), where $_POST['mexcel'] is user-controlled input.Check if you run itEPSS 0.42%Oct 16, 2025
- Medium6.5Hardcoded credentials in gsigel14 ATLAS-EPIC commit f29312c (2025-05-26).Check if you run itEPSS 0.33%Oct 16, 2025
- Medium5.4Boolean SQL injection vulnerability in the web app of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows a low level priviliged user that has access to the platfoCheck if you run itEPSS 0.26%Oct 16, 2025
- Medium5.4SQL injection vulnerability in the cmd component of Base Digitale Group spa product Centrax Open PSIM version 6.1 allows an unauthenticated user to execute arbitrary SQL commands vCheck if you run itEPSS 0.28%Oct 16, 2025
- UnknownAdobe experience_manager Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 1.92%Oct 16, 2025
- High7.5TRUfusion Enterprise Authentication BypassPatch nowKEVEPSS 2.20%Oct 16, 2025
- High8.2Aggie 2.6.1 has a Host Header injection vulnerability in the forgot password functionality, allowing an attacker to reset a user's password.Check if you run itEPSS 0.65%Oct 16, 2025
- Medium5.5A double free issue was addressed with improved memory management.Check if you run itEPSS 0.16%Oct 15, 2025
- Medium5.5A logic issue was addressed with improved restrictions.Check if you run itEPSS 0.15%Oct 15, 2025
- High7.8The issue was addressed with improved authentication.Check if you run itEPSS 0.15%Oct 15, 2025
- Medium4.7The issue was resolved by not loading remote images.Check if you run itEPSS 0.21%Oct 15, 2025
- High8.8Improper certificate validation when connecting to gateways in Devolutions Server 2025.3.2 and earlier allows attackers in MitM position to intercept traffic.Check if you run itEPSS 0.24%Oct 15, 2025
- Medium4.4A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format.Check if you run itEPSS 0.10%Oct 15, 2025
- Medium6.9go-witness and witness are Go modules for generating attestations.Check if you run itEPSS 0.20%Oct 15, 2025
- Critical10.0Allocation of Resources Without Limits or Throttling vulnerability in Azure Access Technology BLU-IC2, Azure Access Technology BLU-IC4 allows Flooding.This issue affects BLU-IC2: tCheck if you run itEPSS 0.37%Oct 15, 2025
- High7.4OpenSearch Data Prepper as an open source data collector for observability data.Check if you run itEPSS 0.19%Oct 15, 2025
- Critical9.4In versions before 20.0.2, it was found that --disallow-code-generation-from-strings is not sufficient for isolating untrusted JavaScript in happy-dom.Check if you run itEPSS 0.35%Oct 15, 2025
Sort