Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8In Sofia on Xiongmai DVR/NVR (AHB7008T-MH-V2 and NBD7024H-P) 4.03.R11 devices, root OS command injection can occur via shell metacharacters in the HostName value via a…Check if you run itEPSS 1.87%Mar 29, 2026
- Critical9.9Hackage package metadata stored XSS vulnerabilityCheck if you run itEPSS 0.43%Mar 28, 2026
- Medium5.4The Quads Ads Manager for Google AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.98.1 due to insufficie…Check if you run itEPSS 0.24%Mar 28, 2026
- High8.0The Ultimate Member plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.2.Check if you run itEPSS 0.42%Mar 27, 2026
- Critical9.3pyLoad is a free and open-source download manager written in Python.Check if you run itEPSS 0.45%Mar 27, 2026
- High7.7LibreChat is a ChatGPT clone with additional features.Check if you run itEPSS 0.35%Mar 27, 2026
- High8.5LibreChat is a ChatGPT clone with additional features.Check if you run itEPSS 0.30%Mar 27, 2026
- Medium6.9Appsmith versions prior to 1.98 expose sensitive instance management API endpoints without authentication.Check if you run itEPSS 0.45%Mar 27, 2026
- High7.1In the latest version of mlflow/mlflow, when the app is enabled, tracing and assessment endpoints are not protected by permission validators.Check if you run itEPSS 0.33%Mar 27, 2026
- High7.2Metabase is an open source business intelligence and embedded analytics tool.Check if you run itEPSS 0.78%Mar 27, 2026
- High8.7A memory leak exists in the Grassroots DICOM library (GDCM).Check if you run itEPSS 0.61%Mar 26, 2026
- Medium5.4Kestra is an open-source, event-driven orchestration platform Versions up to and including 1.3.3 render user-supplied flow YAML metadata fields — description, inputs[]…Check if you run itEPSS 0.34%Mar 26, 2026
- Medium5.3Ech0 is an open-source, self-hosted publishing platform for personal idea sharing.Check if you run itEPSS 0.61%Mar 26, 2026
- Medium4.3iCalendar is a Ruby library for dealing with iCalendar files in the iCalendar format defined by RFC-5545.Check if you run itEPSS 0.37%Mar 26, 2026
- High7.2PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser.Check if you run itEPSS 3.44%Mar 26, 2026
- Medium5.3Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.Check if you run itEPSS 0.36%Mar 26, 2026
- Medium6.5Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload.Check if you run itEPSS 0.57%Mar 26, 2026
- Medium4.3The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized data loss in all versions up to, and including, 8.8.2.Check if you run itEPSS 0.43%Mar 26, 2026
- Medium6.5OpenEMR is a free and open source electronic health records and medical practice management application.Check if you run itEPSS 0.50%Mar 26, 2026
- Medium6.3n8n is an open source workflow automation platform.Check if you run itEPSS 0.31%Mar 25, 2026
- High7.2Modoboa is a mail hosting and management platform.Check if you run itEPSS 0.69%Mar 25, 2026
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CreativeWS MetaMax metamax allows PHP Local Fi…Check if you run itEPSS 0.56%Mar 25, 2026
- High7.5Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Ac…Check if you run itEPSS 0.39%Mar 25, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-commun…Check if you run itEPSS 0.16%Mar 25, 2026
- Critical9.8Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: fro…Check if you run itEPSS 0.51%Mar 25, 2026