Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownWordPress wordpress Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 15.17%Apr 15, 2026
- Critical9.8Fortinet FortiSandbox Path Traversal: '../filedir'Patch nowKEVEPSS 0.72%Apr 14, 2026
- Medium6.5Fortinet Multiple Products Path Traversal VulnerabilityPatch nowKEVEPSS 1.08%Apr 14, 2026
- High7.8Microsoft Defender Insufficient Granularity of Access Control VulnerabilityPatch nowKEVEPSS 0.40%Apr 14, 2026
- Critical9.8Microsoft Internet Key Exchange (IKE) Service Extensions Double Free VulnerabilityPatch nowKEVEPSS 1.62%Apr 14, 2026
- Critical9.8Fortinet FortiSandbox OS Command Injection VulnerabilityPatch nowKEVEPSS 47.36%Apr 14, 2026
- Medium4.3Microsoft Windows Protection Mechanism Failure VulnerabilityPatch nowKEVEPSS 4.90%Apr 14, 2026
- High8.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 0.45%Apr 13, 2026
- Unknownmjdm majordomo Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 7.84%Apr 13, 2026
- Medium6.5Microsoft SharePoint Server Improper Input Validation VulnerabilityPatch nowKEVEPSS 43.38%Apr 12, 2026
- Unknownusememos memos Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 2.93%Apr 12, 2026
- UnknownNETGEAR dgn2200_firmware Improper AuthenticationPatch nowKEVEPSS 2.11%Apr 12, 2026
- Medium6.5Arcane is an interface for managing Docker containers, images, networks, and volumes.Patch nowKEVEPSS 0.72%Apr 10, 2026
- High8.8LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.Patch nowKEVEPSS 3.40%Apr 10, 2026
- UnknownTP-Link archer_ax3000_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 1.06%Apr 10, 2026
- High8.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 0.27%Apr 9, 2026
- High7.5Apache Tomcat Missing Encryption of Sensitive Data VulnerabilityPatch nowKEVEPSS 6.56%Apr 9, 2026
- Critical9.8The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1.Patch nowKEVEPSS 8.09%Apr 9, 2026
- Critical9.3Marimo Remote Code Execution VulnerabilityPatch nowKEVEPSS 37.87%Apr 9, 2026
- UnknownLangflow Langflow Missing Authentication for Critical FunctionPatch nowKEVEPSS 33.29%Apr 9, 2026
- UnknownSPIP saisies Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 5.59%Apr 9, 2026
- UnknownImproper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Patch nowKEVEPSS 51.12%Apr 9, 2026
- Critical9.8The Users manager – PN plugin for WordPress is vulnerable to Privilege Escalation via Arbitrary User Meta Update in all versions up to and including 1.1.15.Patch nowKEVEPSS 1.31%Apr 8, 2026
- Critical9.8WPEverest everest_forms Deserialization of Untrusted DataPatch nowKEVEPSS 2.98%Apr 8, 2026
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.38%Apr 8, 2026