Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3A vulnerability has been found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic.Check if you run itEPSS 0.22%Aug 3, 2025
- Critical9.3An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint expCheck if you run itEPSS 2.78%Aug 1, 2025
- Medium6.9A path traversal vulnerability exists in the Netgear SPH200D Skype phone firmware versions <= 1.0.4.80 in its embedded web server.Check if you run itEPSS 1.41%Aug 1, 2025
- High8.6An authenticated OS command injection vulnerability exists in Netgear routers (tested on the DGN1000B model firmware versions 1.1.00.24 and 1.1.00.45) via the TimeToLive parameterCheck if you run itEPSS 6.19%Aug 1, 2025
- Critical9.3A remote PHP code execution vulnerability exists in InstantCMS version 1.6 and earlier due to unsafe use of eval() within the search view handler.Check if you run itEPSS 3.14%Aug 1, 2025
- Critical9.3An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 (and possibly earlier) in the upload.php script.Check if you run itEPSS 1.68%Aug 1, 2025
- Critical9.3An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper inpuCheck this weekEPSS 16.87%Aug 1, 2025
- Medium6.9webfinger.js is a TypeScript-based WebFinger client that runs in both browsers and Node.js environments.Check if you run itEPSS 0.66%Aug 1, 2025
- Medium6.5The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_dCheck if you run itEPSS 0.34%Aug 1, 2025
- Critical9.8Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint.Check if you run itEPSS 0.38%Aug 1, 2025
- Unknownlylme lylme_spage Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 1.44%Aug 1, 2025
- Critical9.3An OS command injection vulnerability exists in WebTester version 5.x via the install2.php installation script.Check this weekEPSS 13.40%Jul 31, 2025
- Critical9.2An unrestricted file upload vulnerability exists in Simple E-Document versions 3.0 to 3.1 that allows an unauthenticated attacker to bypass authentication by sending a specific cooCheck if you run itEPSS 1.90%Jul 31, 2025
- High8.7A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin.Check if you run itEPSS 2.32%Jul 31, 2025
- UnknownArbitrary Code Execution (ACE) VulnerabilityOpen the advisoryJul 31, 2025
- Medium5.3A stack-based buffer overflow vulnerability exists in the tmUnblock.cgi endpoint of the Linksys WRT120N wireless router.Check if you run itEPSS 1.16%Jul 31, 2025
- Critical9.3An unrestricted file upload vulnerability exists in Kaseya KServer versions prior to 6.3.0.2.Check if you run itEPSS 2.86%Jul 31, 2025
- High8.8A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier.Check if you run itEPSS 2.97%Jul 31, 2025
- Medium6.1A carefully crafted request using the Image plugin could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browseCheck if you run itEPSS 0.47%Jul 31, 2025
- High7.5A carefully crafted request when creating a header link using the wiki markup syntax, which could allow the attacker to execute javascript in the victim's browser and get some sensCheck if you run itEPSS 0.56%Jul 31, 2025
- UnknownOSGeo GeoServer Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 2.30%Jul 31, 2025
- High8.1An issue in Aver PTC310UV2 v.0.1.0000.59 allows a remote attacker to obtain sensitive information via a crafted requestCheck if you run itEPSS 0.77%Jul 30, 2025
- Medium6.5A PHAR deserialization vulnerability in the component /themes/import of PrestaShop v8.2.0 allows attackers to execute arbitrary code via a crafted POST request.Check if you run itEPSS 0.87%Jul 30, 2025
- High8.1Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux.Check if you run itEPSS 0.36%Jul 29, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: HID: core: do not bypass hid_hw_raw_request hid_hw_raw_request() is actually useful to ensure the provided buffeCheck if you run itEPSS 0.24%Jul 28, 2025
Sort