Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3A vulnerability classified as critical was found in deerwms deer-wms-2 up to 3.3.Check if you run itEPSS 0.51%Jul 25, 2025
- Critical9.8The WP Database Backup plugin for WordPress is vulnerable to OS Command Injection in versions before 5.2 via the mysqldump function.Check this weekEPSS 22.05%Jul 25, 2025
- Critical9.8The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the *_ajax_save_optioCheck if you run itEPSS 3.06%Jul 25, 2025
- Medium4.3Abnormal Security /v1.0/rbac/users_v2/{USER_ID}/ before 2025-02-19 allows downgrading the privileges of other user accounts.Check if you run itEPSS 0.28%Jul 25, 2025
- Medium4.1OpenAI Codex CLI before 0.9.0 auto-approves ripgrep (aka rg) execution even with the --pre or --hostname-bin or --search-zip or -z flag.Check if you run itEPSS 0.23%Jul 25, 2025
- High8.8A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05.Check if you run itEPSS 0.58%Jul 25, 2025
- Medium6.1A reflected cross-site scripting (XSS) vulnerability exists in Institute-of-Current-Students v1.0 via the email parameter in the /postquerypublic endpoint.Check if you run itEPSS 0.37%Jul 25, 2025
- Critical9.8Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fieldsCheck if you run itEPSS 0.93%Jul 25, 2025
- High8.8Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img elementCheck if you run itEPSS 0.73%Jul 25, 2025
- Medium6.1OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts.Check if you run itEPSS 0.28%Jul 25, 2025
- Medium6.1OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor.Check if you run itEPSS 0.28%Jul 25, 2025
- Critical9.8An issue in the OTP mechanism of Chavara Family Welfare Centre Chavara Matrimony Site v2.0 allows attackers to bypass authentication via supplying a crafted request.Check if you run itEPSS 0.77%Jul 25, 2025
- High7.1Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an insecure verification mechanism that solCheck if you run itEPSS 0.34%Jul 25, 2025
- High8.8Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext.Check if you run itEPSS 0.66%Jul 25, 2025
- Medium6.1A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the debugbar_Check if you run itEPSS 0.38%Jul 25, 2025
- Low2.9JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter.Check if you run itEPSS 0.30%Jul 25, 2025
- Critical9.4An issue was discovered on IROAD Dashcam FX2 devices.Check if you run itEPSS 0.61%Jul 25, 2025
- Medium4.9CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/users endpoint to leaCheck if you run itEPSS 0.71%Jul 25, 2025
- High8.1DO NOT USE THIS CANDIDATE NUMBER.Open the advisoryJul 25, 2025
- High7.1An issue in ETSI Open-Source MANO (OSM) 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, and 17.0.0 allows a remote authenticated attacker to escalate privileges via the /osm/adCheck if you run itEPSS 0.40%Jul 25, 2025
- High8.4RARLAB WinRAR Improper Input ValidationPatch nowKEVEPSS 1.98%Jul 25, 2025
- Medium5.3A vulnerability was found in deerwms deer-wms-2 up to 3.3.Check if you run itEPSS 0.51%Jul 24, 2025
- High8.3An authentication vulnerability exists in the LG Innotek camera model LNV5110R firmware that allows a malicious actor to upload an HTTP POST request to the devices non-volatile stoCheck if you run itEPSS 0.74%Jul 24, 2025
- Low2.2HCL IEM is affected by an authorization token sent in cookie vulnerability.Check if you run itEPSS 0.20%Jul 24, 2025
- Low3.3HCL IEM is affected by an improper invalidation of access or JWT token vulnerability.Check if you run itEPSS 0.25%Jul 24, 2025
Sort