Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel value is not checked.Check if you run itEPSS 0.20%Sep 22, 2025
- Medium4.3In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer overflow in ocr_line8.Check if you run itEPSS 0.18%Sep 22, 2025
- Medium5.8Profession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api/challenges/{id} and also URLs for eversports, the user-management page, and the plane paCheck if you run itEPSS 0.27%Sep 22, 2025
- High8.8The LB-Link routers, including the BL-AC2100_AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000_AE4 v2.4.9, BL-AC1900_AZ2 v1.0.2, BL-X26_AC8 v1.2.8, and BL-LTE300_DA4 V1.2.3 models, are vulneCheck if you run itEPSS 1.17%Sep 22, 2025
- Medium6.5Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to retrieve arbitrary files from an S3 bucket through its CloudFront distribution viaCheck if you run itEPSS 0.71%Sep 22, 2025
- High8.8Lack of server-side authorisation on department admin assignment APIs in AiKaan IoT Platform allows authenticated users to elevate their privileges by assigning themselves as adminCheck if you run itEPSS 0.30%Sep 22, 2025
- Critical9.8Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a shared, hardcoded SSH private key, allows remote attackers to authCheck if you run itEPSS 0.53%Sep 22, 2025
- Critical9.8AiKaan Cloud Controller uses a single hardcoded SSH private key and the username for remote terminal access to all managed IoT/edge devices.Check if you run itEPSS 0.42%Sep 22, 2025
- Critical9.8The Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information via an unauthenticated Telnet service on port 9990.Check if you run itEPSS 0.55%Sep 22, 2025
- High7.5The Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993, which accepts unauthenticated plaintext commands for controlling streaming, recording, forCheck if you run itEPSS 0.28%Sep 22, 2025
- High8.8Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint.Check if you run itEPSS 0.83%Sep 22, 2025
- Medium6.8The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability.Check if you run itEPSS 0.33%Sep 22, 2025
- Critical9.8The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977.Check if you run itEPSS 0.53%Sep 22, 2025
- High8.8Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation.Check if you run itEPSS 0.49%Sep 22, 2025
- Medium6.5The 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability.Check if you run itEPSS 0.37%Sep 22, 2025
- Critical9.8Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthenticated commands.Check if you run itEPSS 0.64%Sep 22, 2025
- High8.8The Sound4 PULSE-ECO AES67 1.22 web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update package.Check if you run itEPSS 0.35%Sep 22, 2025
- High7.5Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get.Check if you run itEPSS 0.40%Sep 22, 2025
- Medium5.4Stocky POS with Inventory Management & HRM (ui-lib) version 5.0 is affected by a Stored Cross-Site Scripting (XSS) vulnerability within the Products module available to authenticatCheck if you run itEPSS 0.26%Sep 22, 2025
- Medium5.4A SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0.Check if you run itEPSS 0.26%Sep 22, 2025
- Critical9.8A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0.Check if you run itEPSS 0.48%Sep 22, 2025
- High7.3Cross-Site Scripting (XSS) vulnerability was discovered in the Ajax transaction manager endpoint of ARD.Check if you run itEPSS 0.44%Sep 22, 2025
- Medium6.1Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD.Check if you run itEPSS 0.35%Sep 22, 2025
- Medium6.3SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04-23 allows a remote attacker to escalate privileges via the GET parameters in index.Check if you run itEPSS 0.37%Sep 22, 2025
- UnknownCVE-2025-54914 is named in a Cloudflare managed-rules release.Check if you run itEPSS 2.51%Sep 22, 2025
Sort