Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Dynamic Links wp-dynamic-links allows Reflected XSS.This issue affecCheck this weekEPSS 24.00%Aug 14, 2025
- High8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows BlCheck this weekEPSS 28.00%Aug 14, 2025
- Critical9.8FlowiseAI Flowise Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 22.37%Aug 14, 2025
- Critical10.0Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality.Check if you run itEPSS 5.81%Aug 13, 2025
- High7.8Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.Check this weekEPSS 76.00%Aug 12, 2025
- Medium5.3ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform.Check this weekEPSS 35.00%Aug 12, 2025
- High7.3APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access.Check if you run itEPSS 9.00%Aug 12, 2025
- Medium4.2AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessing.Check this weekEPSS 13.00%Aug 12, 2025
- Medium5.3Missing Authorization vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affectsCheck this weekEPSS 24.00%Aug 12, 2025
- High8.8The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user.Check this weekEPSS 27.00%Aug 8, 2025
- Medium4.3Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 inserts Sensitive Information Into Sent Data to authenticated users.Check this weekEPSS 26.00%Aug 7, 2025
- Medium5.4Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows SQL Injection.Check this weekEPSS 24.00%Aug 7, 2025
- Medium6.1Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication configuration data.Check this weekEPSS 25.00%Aug 7, 2025
- Medium5.3Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 has Insufficiently Protected Credentials for requests to remote Excel resources.Check this weekEPSS 29.00%Aug 7, 2025
- Medium5.4Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows Static Code Injection.Check this weekEPSS 24.00%Aug 7, 2025
- Medium6.1Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data, a different vulnerability than CVE-2025-47189.Check this weekEPSS 34.00%Aug 7, 2025
- High8.0Alpine iLX-507 Command Injection Remote Code Execution.Check this weekEPSS 69.00%Aug 1, 2025
- UnknownMicrosoft Windows Untrusted Pointer DereferencePatch nowKEVEPSS 1.98%Aug 1, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: smc: Fix various oops due to inet_sock type confusion.Check this weekEPSS 16.00%Jul 28, 2025
- Medium4.4LsiAgent.exe, a component of SysTrack from Lakeside Software, attempts to load several DLL files which are not present in the default installation.Check this weekEPSS 18.00%Jul 27, 2025
- Critical9.8In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request If the request being processed is not a v4Check if you run itEPSS 0.56%Jul 25, 2025
- Medium6.4The Station Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width' and 'height’ parameter in all versions up to, and including, 2.4.2 due to insufficCheck this weekEPSS 43.00%Jul 24, 2025
- Medium6.1The Latest Post Accordian Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.Check this weekEPSS 12.00%Jul 22, 2025
- UnknownTOTOLINK n600r_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 2.54%Jul 21, 2025
- UnknownCitrix virtual_apps_and_desktops Improper Control of Dynamically-Managed Code ResourcesPatch nowKEVEPSS 46.61%Jul 18, 2025