Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Unknownxiongmaitech uc-httpd Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 28.27%May 22, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion().Check if you run itEPSS 0.11%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple().Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan().Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star().Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id).Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id).Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder.Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate.Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design.Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache.Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete.Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/bulk/delete.Check if you run itEPSS 0.14%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/logs/delete.Check if you run itEPSS 0.14%May 21, 2026
- Medium6.0Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection.Check if you run itEPSS 0.14%May 21, 2026
- Low2.0Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized.Check if you run itEPSS 0.15%May 21, 2026
- Low2.3Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass.Check if you run itEPSS 0.29%May 21, 2026
- Low2.3Concrete CMS 9.5.0 and below is vulnerable to unauthorized file deletion due to an Inverted CSRF token check in the DeleteFile controller.Check if you run itEPSS 0.12%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter.Check if you run itEPSS 0.21%May 21, 2026
- Medium5.1Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text.Check if you run itEPSS 0.21%May 21, 2026
- Medium5.1In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline.Check if you run itEPSS 0.17%May 21, 2026
- Medium5.1Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low…Check if you run itEPSS 0.22%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the corresponding do_update() method in concre…Check if you run itEPSS 0.13%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php.Check if you run itEPSS 0.17%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group.Check if you run itEPSS 0.30%May 21, 2026
Sort