Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8In Jenkins WSO2 Oauth Plugin 1.0 and earlier, authentication claims are accepted without validation by the "WSO2 Oauth" security realm, allowing unauthenticated attackers to log inCheck if you run itEPSS 0.65%May 14, 2025
- Medium5.9Jenkins DingTalk Plugin 2.7.3 and earlier unconditionally disables SSL/TLS certificate and hostname validation for connections to the configured DingTalk webhooks.Check if you run itEPSS 0.23%May 14, 2025
- Medium4.3Missing permission checks in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers with Overall/Read permission to connect to an attacker-specifieCheck if you run itEPSS 0.33%May 14, 2025
- Medium4.3A cross-site request forgery (CSRF) vulnerability in Jenkins Cadence vManager Plugin 4.0.1-286.v9e25a_740b_a_48 and earlier allows attackers to connect to an attacker-specified URLCheck if you run itEPSS 0.25%May 14, 2025
- High8.8Jenkins Health Advisor by CloudBees Plugin 374.v194b_d4f0c8c8 and earlier does not escape responses from the Jenkins Health Advisor server, resulting in a stored cross-site scriptiCheck if you run itEPSS 0.56%May 14, 2025
- Critical9.1In Jenkins OpenID Connect Provider Plugin 96.vee8ed882ec4d and earlier the generation of build ID Tokens uses potentially overridden values of environment variables, in conjunctionCheck if you run itEPSS 0.64%May 14, 2025
- Medium4.4IBM WebSphere Application Server 8.5 and 9.0 is vulnerable to cross-site scripting.Check if you run itEPSS 0.25%May 14, 2025
- High7.5IBM Semeru Runtime 8.0.302.0 through 8.0.442.0, 11.0.12.0 through 11.0.26.0, 17.0.0.0 through 17.0.14.0, and 21.0.0.0 through 12.0.6.0 is vulnerable to a denial of service caused bCheck if you run itEPSS 0.28%May 14, 2025
- Medium5.3Using the AES-128-CCM algorithm for IPSec on certain Palo Alto Networks PAN-OS® firewalls (PA-7500, PA-5400, PA-5400f, PA-3400, PA-1600, PA-1400, and PA-400 Series) leads to unencrCheck if you run itEPSS 0.17%May 14, 2025
- Low2.0Web sessions in the web interface of Palo Alto Networks Prisma® Cloud Compute Edition do not expire when users are deleted, which makes Prisma Cloud Compute Edition susceptible toCheck if you run itEPSS 0.37%May 14, 2025
- Medium4.8An improper input neutralization vulnerability in the management web interface of the Palo Alto Networks PAN-OS® software enables a malicious authenticated read-write administratorCheck if you run itEPSS 0.42%May 14, 2025
- Critical9.3Improper Restriction of XML External Entity Reference vulnerability in bonigarcia webdrivermanager WebDriverManager on Windows, MacOS, Linux (XML parsing components modules) allowsCheck if you run itEPSS 0.56%May 14, 2025
- Medium5.2An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable theCheck if you run itEPSS 0.14%May 14, 2025
- Medium6.5A code injection vulnerability in the Palo Alto Networks Cortex XDR® Broker VM allows an authenticated user to execute arbitrary code with root privileges on the host operating sysCheck if you run itEPSS 0.53%May 14, 2025
- Low1.2A reflected cross-site scripting (XSS) vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScrCheck this weekEPSS 46.30%May 14, 2025
- Medium6.9A missing authentication vulnerability in Palo Alto Networks Cortex XDR® Broker VM allows an unauthenticated user to disable certain internal services on the Broker VM.Check if you run itEPSS 0.46%May 14, 2025
- High8.3Out-of-bounds Write vulnerability in PointCloudLibrary pcl allows Overflow Buffers.Check if you run itEPSS 0.42%May 14, 2025
- High7.1An incorrect privilege management vulnerability in the OPSWAT MetaDefender Endpoint Security SDK used by the Palo Alto Networks GlobalProtect™ app on Windows devices allows a localCheck if you run itEPSS 0.16%May 14, 2025
- High8.8CWE-611 Improper Restriction of XML External Entity Reference in the getDocumentBuilder() method of WebDav servlet in Peergos.Check if you run itEPSS 0.43%May 14, 2025
- Critical9.2A vulnerability exists in the inftrees.c component of the zlib library, which is bundled within the PointCloudLibrary (PCL).Check if you run itEPSS 0.55%May 14, 2025
- High8.7Divide By Zero vulnerability in davisking dlib allows remote attackers to cause a denial of service via a crafted file.Check if you run itEPSS 0.48%May 14, 2025
- Medium4.3Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to impact app integrity via network access.Check if you run itEPSS 0.31%May 14, 2025
- Medium6.5Buffer over-read in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access.Check if you run itEPSS 0.58%May 14, 2025
- Medium6.5Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access.Check if you run itEPSS 0.55%May 14, 2025
- High8.2A missing exception check in Palo Alto Networks PAN-OS® software with the web proxy feature enabled allows an unauthenticated attacker to send a burst of maliciously crafted packetCheck if you run itEPSS 0.44%May 14, 2025
Sort