Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low3.1Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate permissions for the API endpoint /plugins/playbooks/api/v0/signal/keywords/ignorCheck if you run itEPSS 0.28%Apr 24, 2025
- Medium6.5Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to validate the uniqueness and quantity of task actions within the UpdateRunTaskActions GraphQL operaCheck if you run itEPSS 0.40%Apr 24, 2025
- Medium6.5Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.10 fail to properly validate the props used by the RetrospectivePost custom post type in the Playbooks pluginCheck if you run itEPSS 0.50%Apr 24, 2025
- Medium6.8Use of hard-coded cryptographic key vulnerability in i-PRO Configuration Tool affects the network system for i-PRO Co., Ltd.Check if you run itEPSS 0.17%Apr 24, 2025
- High8.6The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perforCheck if you run itEPSS 2.41%Apr 24, 2025
- Medium4.8The Category Posts Widget WordPress plugin before 4.9.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored CCheck if you run itEPSS 0.27%Apr 24, 2025
- None0.0Not usedOpen the advisoryApr 24, 2025
- None0.0Not usedOpen the advisoryApr 24, 2025
- None0.0Not usedOpen the advisoryApr 24, 2025
- None0.0Not usedOpen the advisoryApr 24, 2025
- None0.0Not usedOpen the advisoryApr 24, 2025
- None0.0Not usedOpen the advisoryApr 24, 2025
- None0.0Not usedOpen the advisoryApr 24, 2025
- None0.0Not usedOpen the advisoryApr 24, 2025
- Medium4.4The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the board_header and board_footer parameters in all versions up to, and including, 1.8.6 dueCheck if you run itEPSS 0.24%Apr 24, 2025
- Medium5.9Westermo WeOS 5 through 5.23.0 allows a reboot via a malformed ESP packet.Check if you run itEPSS 0.38%Apr 24, 2025
- Medium6.8The unsafe globals in Picklescan before 0.0.25 do not include ssl.Check if you run itEPSS 0.23%Apr 24, 2025
- Medium6.5A vulnerability was found in code-projects Online Class and Exam Scheduling System 1.0 in /Scheduling/pages/profile_update.php.Check if you run itEPSS 0.27%Apr 24, 2025
- Medium6.5A vulnerability was found in Code-Projects Online Class and Exam Scheduling System 1.0 in the file /Scheduling/pages/class_save.php.Check if you run itEPSS 0.27%Apr 24, 2025
- Medium4.8A vulnerability has been discovered in the code-projects Online Class and Exam Scheduling System 1.0.Check if you run itEPSS 0.25%Apr 24, 2025
- Medium6.5ITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL injection vulnerability via the component Forgotpassword.aspx.Check if you run itEPSS 0.32%Apr 24, 2025
- High8.0Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles.Check if you run itEPSS 0.27%Apr 24, 2025
- Low3.7IBM InfoSphere Information Server 11.7 DataStage Flow Designer transmits sensitive information via URL or query parameters that could be exposed to an unauthorized actor using manCheck if you run itEPSS 0.18%Apr 23, 2025
- Medium4.3IBM InfoSphere Information 11.7 Server authenticated user to obtain sensitive information when a detailed technical error message is returned in a request.Check if you run itEPSS 0.30%Apr 23, 2025
- Medium6.3IBM InfoSphere Information 11.7 Server does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.Check if you run itEPSS 0.25%Apr 23, 2025
Sort