Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.0An authenticated user may trigger a use after free that may result in MongoDB Server crash and other unexpected behavior, even if the user does not have authorization to shut downCheck if you run itEPSS 0.26%Jun 26, 2025
- High8.9DataEase is an open source business intelligence and data visualization tool.Check if you run itEPSS 0.93%Jun 26, 2025
- Medium5.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Paragraphs table allows Cross-Site Scripting (XSS).This issue affects PCheck if you run itEPSS 0.22%Jun 26, 2025
- Medium5.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple XML sitemap allows Cross-Site Scripting (XSS).This issue affectsCheck if you run itEPSS 0.22%Jun 26, 2025
- Medium4.8Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Enterprise MFA - TFA for Drupal allows Authentication Bypass.This issue affects Enterprise MFA - TFCheck if you run itEPSS 0.24%Jun 26, 2025
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal CKEditor5 Youtube allows Cross-Site Scripting (XSS).This issue affectsCheck if you run itEPSS 0.22%Jun 26, 2025
- Medium4.3Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Klaro Cookie & Consent Management allows Cross-Site Scripting (XSS).ThiCheck if you run itEPSS 0.26%Jun 26, 2025
- High8.8Cross-Site Request Forgery (CSRF) vulnerability in Drupal Open Social allows Cross Site Request Forgery.This issue affects Open Social: from 0.0.0 before 12.3.14, from 12.4.0 beforCheck if you run itEPSS 0.18%Jun 26, 2025
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal GLightbox allows Cross-Site Scripting (XSS).This issue affects GLightboCheck if you run itEPSS 0.21%Jun 26, 2025
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Toc.Js allows Cross-Site Scripting (XSS).This issue affects Toc.Js: froCheck if you run itEPSS 0.22%Jun 26, 2025
- Medium5.1A vulnerability was found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic.Check if you run itEPSS 0.38%Jun 26, 2025
- Medium5.1A vulnerability has been found in LabRedesCefetRJ WeGIA 3.4.0 and classified as problematic.Check if you run itEPSS 0.39%Jun 26, 2025
- High8.5A vulnerability, which was classified as critical, was found in RT-Thread up to 5.1.0.Check if you run itEPSS 0.29%Jun 26, 2025
- High8.1Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Attachments by filename keyword report.Check if you run itEPSS 1.32%Jun 26, 2025
- High8.1Zohocorp ManageEngine Exchange reporter Plus version 5722 and below are vulnerable to Stored XSS in the Folder-wise read mails with subject report.Check if you run itEPSS 1.32%Jun 26, 2025
- High8.7Certain hybrid DVR models (HBF-09KD and HBF-16NK) from Hunt Electronic have an OS Command Injection vulnerability, allowing remote attackers with regular privileges to inject arbitCheck if you run itEPSS 0.91%Jun 26, 2025
- Critical9.8Certain hybrid DVR models ((HBF-09KD and HBF-16NK)) from Hunt Electronic have an Exposure of Sensitive Information vulnerability, allowing unauthenticated remote attackers to direcCheck if you run itEPSS 0.55%Jun 26, 2025
- None0.0A sensitive information exposure vulnerability in System Information Reporter (SIR) 1.0.3 and prior allows an authenticated non-admin local user to extract sensitive information stCheck if you run itEPSS 0.14%Jun 26, 2025
- None0.0A path traversal vulnerability in System Information Reporter (SIR) 1.0.3 and prior allowed an authenticated high privileged user to issue malicious ePO post requests to System InfCheck if you run itEPSS 0.18%Jun 26, 2025
- High7.2A path or symbolic link manipulation vulnerability in SIR 1.0.3 and prior versions allows an authenticated non-admin local user to overwrite system files with SIR backup files, whiCheck if you run itEPSS 0.16%Jun 26, 2025
- None0.0Rejected reason: Not a vulnerability.Open the advisoryJun 26, 2025
- Low2.3Improper Input Validation vulnerability in Mozilla neqo leads to an unexploitable crash..This issue affects neqo: from 0.4.24 through 0.13.2.Check if you run itEPSS 0.25%Jun 26, 2025
- Medium5.9cloud-init through 25.1.2 includes the systemd socket unit cloud-init-hotplugd.socket with default SocketMode that grants 0666 permissions, making it world-writable.Check if you run itEPSS 0.14%Jun 26, 2025
- High7.2The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due to insufficient inputCheck if you run itEPSS 0.30%Jun 26, 2025
- High8.8When a non-x86 platform is detected, cloud-init grants root access to a hardcoded url with a local IP address.Check if you run itEPSS 0.26%Jun 26, 2025
Sort