Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low3.1Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information abCheck if you run itEPSS 0.22%Jun 11, 2025
- Medium4.1Mattermost versions 10.7.x <= 10.7.1, 10.6.x <= 10.6.3, 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly validate LDAP group ID attributes, allowing an authenticated administraCheck if you run itEPSS 0.28%Jun 11, 2025
- High8.8The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23.Check if you run itEPSS 0.53%Jun 11, 2025
- Low2.1There is a "Use After Free" vulnerability in Qt's QHttp2ProtocolHandler in the QtNetwork module.Check if you run itEPSS 0.14%Jun 11, 2025
- Medium5.2A vulnerability has been identified in Perfect Harmony GH180 (All versions >= V8.0 < V8.3.3 with NXGPro+ controller manufactured between April 2020 to April 2025).Check if you run itEPSS 0.21%Jun 11, 2025
- High8.8The WordPress Automatic Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'core.php' file in all versions up to, aCheck if you run itEPSS 0.76%Jun 11, 2025
- High7.2The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can be deleted from in all versions up to, aCheck if you run itEPSS 0.94%Jun 11, 2025
- Medium4.9The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.68.10.Check if you run itEPSS 0.42%Jun 11, 2025
- Medium6.4The Zotpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘nickname’ parameter in all versions up to, and including, 7.3.15 due to insufficient input sCheck if you run itEPSS 0.31%Jun 11, 2025
- None0.0Not usedOpen the advisoryJun 11, 2025
- None0.0Not usedOpen the advisoryJun 11, 2025
- None0.0Not usedOpen the advisoryJun 11, 2025
- None0.0Not usedOpen the advisoryJun 11, 2025
- None0.0Not usedOpen the advisoryJun 11, 2025
- None0.0Not usedOpen the advisoryJun 11, 2025
- None0.0Not usedOpen the advisoryJun 11, 2025
- None0.0Not usedOpen the advisoryJun 11, 2025
- None0.0Not usedOpen the advisoryJun 11, 2025
- Critical9.5Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession of the agent's key toCheck if you run itEPSS 0.34%Jun 11, 2025
- Critical9.5Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure the agent to connectCheck if you run itEPSS 0.64%Jun 11, 2025
- High8.8Type Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.Check this weekEPSS 13.34%Jun 11, 2025
- High8.8Use after free in Media in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Check if you run itEPSS 0.40%Jun 11, 2025
- High7.8A vulnerability in the digital signature verification process does not properly validate variable attributes which allows an attacker to bypass signature verification by creating aCheck if you run itEPSS 0.48%Jun 11, 2025
- Medium4.2Apple Multiple Products Unspecified VulnerabilityPatch nowKEVEPSS 1.19%Jun 11, 2025
- UnknownZoho firewall_analyzer Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 99.29%Jun 11, 2025
Sort