Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7A path traversal vulnerability exists in httpdasm version 0.92, a lightweight Windows HTTP server, that allows unauthenticated attackers to read arbitrary files on the host system.Check if you run itEPSS 2.08%Jul 23, 2025
- Critical9.3An unauthenticated OS command injection vulnerability exists within Xdebug versions 2.5.5 and earlier, a PHP debugging extension developed by Derick Rethans.Check if you run itEPSS 7.13%Jul 23, 2025
- High8.5A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux (developed by Wuhan Deepin Technology Co., Ltd.).Check if you run itEPSS 0.48%Jul 23, 2025
- Critical9.3The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers.Check if you run itEPSS 1.31%Jul 23, 2025
- High8.7An unauthenticated path traversal vulnerability exists in Dicoogle PACS Web Server version 2.5.0 and possibly earlier.Check if you run itEPSS 1.97%Jul 23, 2025
- Critical9.3oscommerce online_merchant Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 4.56%Jul 23, 2025
- Critical9.3Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authentication is disabled, which is the default configuration.Check if you run itEPSS 2.51%Jul 23, 2025
- Medium6.3A bug in Apache HTTP Server 2.4.64 results in all "RewriteCond expr ..." tests evaluating as "true".Check if you run itEPSS 0.88%Jul 23, 2025
- High7.0A vulnerability in Imprivata Enterprise Access Management (formerly Imprivata OneSign) allows bypassing the login screen of the shared kiosk workstation and allows unauthorized accCheck if you run itEPSS 0.21%Jul 23, 2025
- Critical9.8An unauthenticated remote attacker may use a stack based buffer overflow in the u-link Management API to gain full access on the affected devices.Check if you run itEPSS 0.80%Jul 23, 2025
- High8.8An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web InterfaceCheck if you run itEPSS 0.84%Jul 23, 2025
- High8.8An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web InterfaceCheck if you run itEPSS 0.84%Jul 23, 2025
- Critical9.2The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability.Check if you run itEPSS 0.18%Jul 23, 2025
- High8.1A vulnerability has been found in Dahua products.Check if you run itEPSS 0.87%Jul 23, 2025
- High8.1A vulnerability has been found in Dahua products.Check if you run itEPSS 0.91%Jul 23, 2025
- Medium6.1Qwizcards Reflected Cross-Site Scripting (XSS)Patch nowKEVEPSS 0.50%Jul 23, 2025
- High8.2Improper Restriction of XML External Entity Reference vulnerability in Samsung Electronics MagicINFO 9 Server allows Server Side Request Forgery.This issue affects MagicINFO 9 ServCheck this weekEPSS 17.70%Jul 23, 2025
- High7.3Improper Authentication vulnerability in Samsung Electronics MagicINFO 9 Server allows Authentication Bypass.This issue affects MagicINFO 9 Server: less than 21.1080.0.Check if you run itEPSS 0.52%Jul 23, 2025
- None0.0Bun Shell does not invoke /bin/sh, or any other interpreter, for template literals created with the $ function.Open the advisoryJul 23, 2025
- High8.7All versions of the package files-bucket-server are vulnerable to Directory Traversal where an attacker can traverse the file system and access files outside of the intended directCheck if you run itEPSS 0.76%Jul 23, 2025
- High8.8All versions of the package private-ip are vulnerable to Server-Side Request Forgery (SSRF) where an attacker can provide an IP or hostname that resolves to a multicast IP addressCheck if you run itEPSS 0.38%Jul 23, 2025
- Medium5.3Improper validation of specified quantity in input issue exists in Real-time Bus Tracking System versions prior to 1.1.Check if you run itEPSS 0.33%Jul 23, 2025
- Medium5.9Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in NTP Region functionality in Synology Router Manager (SRM) before 1.3.1-9346-11Check if you run itEPSS 0.24%Jul 23, 2025
- Medium5.9Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in VPN Setting functionality in Synology Router Manager (SRM) before 1.3.1-9346-1Check if you run itEPSS 0.24%Jul 23, 2025
- High7.2Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in DDNS Record functionality in Synology Router Manager (SRM) before 1.3.1-Check if you run itEPSS 1.20%Jul 23, 2025
Sort