Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.6Unsafe default file type filter policy in HCL Leap allows execution of unsafe JavaScript in deployed applications.Check if you run itEPSS 0.29%Apr 24, 2025
- Low3.2Missing "no cache" headers in HCL Leap permits user directory information to be cached.Check if you run itEPSS 0.16%Apr 24, 2025
- Low3.2Missing "no cache" headers in HCL Leap permits sensitive data to be cached.Check if you run itEPSS 0.16%Apr 24, 2025
- Critical9.3Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issueCheck if you run itEPSS 0.58%Apr 24, 2025
- Critical9.1h11 is a Python implementation of HTTP/1.1.Check if you run itEPSS 0.59%Apr 24, 2025
- Critical9.2YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp.Check if you run itEPSS 0.26%Apr 24, 2025
- High7.1Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters.Check if you run itEPSS 0.24%Apr 24, 2025
- Medium5.3Insufficient default configuration in HCL Leap allows anonymous access to directory information.Check if you run itEPSS 0.31%Apr 24, 2025
- Medium6.3Insufficient sanitization policy in HCL Leap allows client-side script injection in the deployed application through the HTML widget.Check if you run itEPSS 0.31%Apr 24, 2025
- Low3.7Insufficient sanitization in HCL Leap allows client-side script injection in the authoring environment.Check if you run itEPSS 0.25%Apr 24, 2025
- Medium6.5Multiple vectors in HCL Leap allow client-side script injection in the authoring environment and deployed applications.Check if you run itEPSS 0.26%Apr 24, 2025
- Medium4.1Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.Check if you run itEPSS 0.28%Apr 24, 2025
- Medium5.4Cross-Site Request Forgery (CSRF) vulnerability in nghialuu Zalo Official Live Chat zalo-official-live-chat allows Cross Site Request Forgery.This issue affects Zalo Official LiveCheck if you run itEPSS 0.16%Apr 24, 2025
- High7.2Deserialization of Untrusted Data vulnerability in Prisna Social Counter social-counter allows Object Injection.This issue affects Social Counter: from n/a through <= 2.0.5.Check if you run itEPSS 0.58%Apr 24, 2025
- Medium5.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devignstudiosltd COVID-19 (Coronavirus) Update Your Customers covid-19-alert aCheck if you run itEPSS 0.23%Apr 24, 2025
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in ldrumm Unsafe Mimetypes unsafe-mimetypes allows Stored XSS.This issue affects Unsafe Mimetypes: from n/a through <= 0.1.4.Check if you run itEPSS 0.15%Apr 24, 2025
- High7.2Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affects Flickr Shortcode ImCheck if you run itEPSS 0.58%Apr 24, 2025
- Medium4.9Server-Side Request Forgery (SSRF) vulnerability in Ankur Vishwakarma WP AVCL Automation Helper (formerly WPFlyLeads) woozap allows Server Side Request Forgery.This issue affects WCheck if you run itEPSS 0.21%Apr 24, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFable Fable Extra fable-extra allows DOM-Based XSS.This issue affects FableCheck if you run itEPSS 0.27%Apr 24, 2025
- Medium4.3Missing Authorization vulnerability in M.Code Media Library Downloader media-library-downloader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aCheck if you run itEPSS 0.26%Apr 24, 2025
- Medium6.4Server-Side Request Forgery (SSRF) vulnerability in Derek Springer BeerXML Shortcode beerxml-shortcode allows Server Side Request Forgery.This issue affects BeerXML Shortcode: fromCheck if you run itEPSS 0.22%Apr 24, 2025
- Medium4.9Server-Side Request Forgery (SSRF) vulnerability in josheli Simple Google Photos Grid simple-google-photos-grid allows Server Side Request Forgery.This issue affects Simple GoogleCheck if you run itEPSS 0.24%Apr 24, 2025
- Medium5.3Missing Authorization vulnerability in vinodvaswani9 Bulk Assign Linked Products For WooCommerce wc-bulk-assign-linked-products allows Accessing Functionality Not Properly ConstraiCheck if you run itEPSS 0.34%Apr 24, 2025
- Medium5.3Missing Authorization vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affeCheck if you run itEPSS 0.34%Apr 24, 2025
- Medium5.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Stored XSCheck if you run itEPSS 0.28%Apr 24, 2025
Sort