Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.9QuickCMS sends password and login via GET Request.Check if you run itEPSS 0.14%Aug 28, 2025
- Medium6.9QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality.Check if you run itEPSS 0.15%Aug 28, 2025
- Critical9.8In the Linux kernel, the following vulnerability has been resolved: tls: separate no-async decryption request handling from async If we're not doing async, the handling is much simCheck if you run itEPSS 0.33%Aug 28, 2025
- Medium5.3The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including,Check if you run itEPSS 0.30%Aug 28, 2025
- High8.8The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.6.Check if you run itEPSS 0.25%Aug 28, 2025
- Medium5.3Incorrect access control in the endpoint /goform/ate of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 allows attackers to escalate privileges or access sensitive components viaCheck if you run itEPSS 0.24%Aug 28, 2025
- Critical9.8D-Link dir-868l_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 6.97%Aug 28, 2025
- High7.7An authentication bypass vulnerability in Arcserve Unified Data Protection (UDP) allows unauthenticated attackers to gain unauthorized access to protected functionality or user accCheck if you run itEPSS 0.37%Aug 27, 2025
- Medium5.3An issue has been discovered in GitLab CE/EE affecting all versions from 14.1 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that that under certain conditions could havCheck if you run itEPSS 0.37%Aug 27, 2025
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in GeroNikolov Instant Breaking News instant-breaking-news allows Stored XSS.This issue affects Instant Breaking News: from n/a throCheck if you run itEPSS 0.11%Aug 27, 2025
- Medium4.4Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through <= 1.3.2Check if you run itEPSS 0.16%Aug 27, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Plugins and Snippets Simple Page Access Restriction simple-page-access-restriction allows Cross Site Request Forgery.This issue aCheck if you run itEPSS 0.13%Aug 27, 2025
- Medium5.0A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attackerCheck if you run itEPSS 0.30%Aug 27, 2025
- Medium5.4A vulnerability in the REST API endpoints of Cisco Nexus Dashboard and Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an authenticated, low-privileged, remote attackerCheck if you run itEPSS 0.26%Aug 27, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Backup Bolt Backup Bolt backup-bolt allows Cross Site Request Forgery.This issue affects Backup Bolt: from n/a through <= 1.5.0.Check if you run itEPSS 0.13%Aug 27, 2025
- Medium6.1A template injection vulnerability leading to reflected cross-site scripting (XSS) has been identified in version 1.7.1, requiring authenticated admin access for exploitation.Check if you run itEPSS 0.28%Aug 27, 2025
- Medium6.3Firecrawl turns entire websites into LLM-ready markdown or structured data.Check if you run itEPSS 0.28%Aug 26, 2025
- Medium5.3An access control vulnerability was discovered in the Request Trace and Download Trace functionalities of CMC before 25.1.0 due to a specific access restriction not being properlyCheck if you run itEPSS 0.21%Aug 26, 2025
- Medium4.7The WordPress Automatic Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.118.0.Check if you run itEPSS 0.19%Aug 26, 2025
- Medium6.1A Stored Cross-Site Scripting (XSS) vulnerability in SourceCodester FAQ Management System 1.0 allows an authenticated attacker to inject malicious JavaScript into the 'question' anCheck if you run itEPSS 0.29%Aug 26, 2025
- Medium5.5request-filtering-agent is an http(s).Agent implementation that blocks requests to Private/Reserved IP addresses.Check if you run itEPSS 0.46%Aug 25, 2025
- High8.7The Scratch Channel is a news website.Check if you run itEPSS 0.32%Aug 25, 2025
- Medium5.1A vulnerability was found in kalcaddle kodbox 1.61.Check if you run itEPSS 0.31%Aug 25, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Kevin Langley Jr.Check if you run itEPSS 0.12%Aug 25, 2025
- Medium5.3Improper Handling of Length Parameter Inconsistency vulnerability in web server function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote unauthentiCheck if you run itEPSS 0.59%Aug 25, 2025
Sort