Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an improper authentication vulnerability in SAML processing.Check if you run itEPSS 0.25%Oct 12, 2026
- High7.5On Azure deployments, Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive authentication information in…Check if you run itEPSS 0.40%Oct 12, 2026
- High7.5Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console.Check if you run itEPSS 0.15%Oct 12, 2026
- High7.5Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not consistently record successful authentication events in audit logs, which…Check if you run itEPSS 0.32%Oct 12, 2026
- High7.5Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authentication validation weakness that could allow an attacker to use…Check if you run itEPSS 0.29%Oct 12, 2026
- High7.7A flaw was found in the OpenShift console.Check if you run itEPSS 0.27%Oct 12, 2026
- High8.5Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations.Check if you run itEPSS 0.29%Oct 12, 2026
- Medium5.3Admidio 5.0.0 before 5.0.15 contains an unauthenticated stored cross-site scripting vulnerability in RegistrationPresenter.php, which inserts the raw FIRST_NAME regist…Check if you run itEPSS 0.20%Oct 12, 2026
- High8.7Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root.Check if you run itEPSS 0.35%Oct 12, 2026
- Medium6.9Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access…Check if you run itEPSS 0.26%Oct 12, 2026
- Medium5.3Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll.Check if you run itEPSS 0.20%Oct 12, 2026
- High8.7Grav Git Sync 1.0.2 through 3.4.12 contains a command injection vulnerability that allows authenticated content editors to execute OS commands by injecting shell subst…Check if you run itEPSS 1.22%Oct 12, 2026
- Medium6.9Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the c…Check if you run itEPSS 0.27%Oct 12, 2026
- High8.5Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens by authoring a page at the reset route.Check if you run itEPSS 0.28%Oct 12, 2026
- High8.6Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two-factor authentication thro…Check if you run itEPSS 0.35%Oct 12, 2026
- High7.1vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow.Check if you run itEPSS 0.42%Oct 12, 2026
- Medium6.0Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user c…Check if you run itEPSS 0.23%Oct 12, 2026
- High8.7Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators.Check if you run itEPSS 0.48%Oct 12, 2026
- High8.2Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery,…Check if you run itEPSS 0.35%Oct 12, 2026
- Medium5.1Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks…Check if you run itEPSS 0.18%Oct 12, 2026
- Medium5.3Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an expli…Check if you run itEPSS 0.27%Oct 12, 2026
- High7.1Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns.Check if you run itEPSS 0.27%Oct 12, 2026
- High8.5Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing ja…Check if you run itEPSS 0.28%Oct 12, 2026
- High8.4Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by up…Check if you run itEPSS 0.25%Oct 12, 2026
- High8.6Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's sessio…Check if you run itEPSS 0.14%Oct 12, 2026
Sort