Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8Drupal Core SQL Injection VulnerabilityPatch nowKEVEPSS 15.70%May 20, 2026
- Critical10.0Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using Malicious Files.Patch nowKEVEPSS 0.52%May 20, 2026
- Unknownsquirrelmail squirrelmail Improper Input ValidationPatch nowKEVEPSS 32.16%May 20, 2026
- Critical9.8Piotnet piotnet_forms Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.87%May 19, 2026
- Critical9.8Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.87%May 19, 2026
- High7.5Microsoft Defender Denial of Service VulnerabilityPatch nowKEVEPSS 1.27%May 19, 2026
- High7.8Microsoft Defender Link Following VulnerabilityPatch nowKEVEPSS 0.44%May 19, 2026
- Critical10.0CtrlPanel is open-source billing software for hosting providers.Patch nowKEVEPSS 4.54%May 19, 2026
- UnknownOracle marketing Missing Authentication for Critical FunctionPatch nowKEVEPSS 0.60%May 19, 2026
- UnknownOracle marketing Missing Authentication for Critical FunctionPatch nowKEVEPSS 0.65%May 19, 2026
- UnknownSonicWall SonicOS Authentication Bypass by Primary WeaknessPatch nowKEVEPSS 0.49%May 19, 2026
- UnknownWindows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityPatch nowKEVEPSS 22.15%May 19, 2026
- Critical9.3dify dify Relative Path TraversalPatch nowKEVEPSS 1.89%May 18, 2026
- UnknownImproper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Patch nowKEVEPSS 2.73%May 18, 2026
- UnknownAsusWRT 'handle_request' Function Authentication BypassPatch nowKEVEPSS 87.26%May 17, 2026
- Unknowncomfy comfyui-manager Unprotected Alternate ChannelPatch nowKEVEPSS 1.39%May 16, 2026
- Unknownonedev_project onedev Exposure of Sensitive Information to an Unauthorized ActorPatch nowKEVEPSS 24.53%May 16, 2026
- Unknownwelaunch wordpress_country_selector Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 1.40%May 16, 2026
- High8.8The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36.Patch nowKEVEPSS 0.77%May 15, 2026
- High8.6lfprojects mlflow Authentication Bypass by Primary WeaknessPatch nowKEVEPSS 1.41%May 15, 2026
- Critical9.4Gotenberg is a Docker-powered stateless API for PDF files.Patch nowKEVEPSS 1.77%May 14, 2026
- Critical9.8Gotenberg is a Docker-powered stateless API for PDF files.Patch nowKEVEPSS 3.67%May 14, 2026
- Critical9.8The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versions 3.4.0 to 3.4.1.1.Patch nowKEVEPSS 3.01%May 14, 2026
- High8.7FunnelKit funnel_builder Missing AuthorizationPatch nowKEVEPSS 0.49%May 14, 2026
- Medium6.1Microsoft Exchange Server Cross-Site Scripting VulnerabilityPatch nowKEVEPSS 0.52%May 14, 2026