Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.6Perle IOLAN STS/SCS terminal server models with firmware versions prior to 6.0 allow authenticated OS command injection via the restricted shell accessed over Telnet or SSH.Check if you run itEPSS 1.57%Mar 17, 2026
- Medium6.5Apache Airflow versions 3.0.0 through 3.1.7 FastAPI DagVersion listing API does not apply per-DAG authorization filtering when the request is made with dag_id set to "…Check if you run itEPSS 0.64%Mar 17, 2026
- Medium5.2The extension fails to properly define allowed classes used when deserializing transport failure metadata.Check if you run itEPSS 0.22%Mar 17, 2026
- Critical9.8A command injection vulnerability in the minimal_wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitra…Check if you run itEPSS 2.14%Mar 16, 2026
- Medium4.3Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to validate team-specific upload_file permissions which allows a guest user to post fi…Check if you run itEPSS 0.38%Mar 16, 2026
- Low2.7AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.Check if you run itEPSS 0.34%Mar 16, 2026
- Medium6.5SiYuan is a personal knowledge management system.Check if you run itEPSS 0.36%Mar 16, 2026
- Medium4.3Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to sanitize client-supplied post metadata which allows an authenticated attacker to sp…Check if you run itEPSS 0.11%Mar 16, 2026
- High8.8This issue affects Apache Spark: before 3.5.7 and 4.0.1.Check if you run itEPSS 5.42%Mar 16, 2026
- UnknownImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 3.40%Mar 16, 2026
- Medium4.3The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_menu_item()…Check if you run itEPSS 0.35%Mar 13, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter allows DO…Check if you run itEPSS 0.23%Mar 13, 2026
- Medium5.4Missing Authorization vulnerability in Metagauss RegistrationMagic custom-registration-form-builder-with-submission-manager allows Exploiting Incorrectly Configured Ac…Check if you run itEPSS 0.30%Mar 13, 2026
- Medium6.4The GetGenie plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.3.2 due to missing validation on a user con…Check if you run itEPSS 0.24%Mar 13, 2026
- High8.2FreeRDP is a free implementation of the Remote Desktop Protocol.Check if you run itEPSS 0.51%Mar 13, 2026
- Low1.7Backstage is an open framework for building developer portals.Check if you run itEPSS 0.49%Mar 12, 2026
- Medium4.7Backstage is an open framework for building developer portals.Check if you run itEPSS 0.24%Mar 12, 2026
- High7.82FAuth is a web app to manage Two-Factor Authentication (2FA) accounts and generate their security codes.Check if you run itEPSS 0.54%Mar 11, 2026
- Medium4.3OpenEMR is a free and open source electronic health records and medical practice management application.Check if you run itEPSS 0.35%Mar 11, 2026
- High8.3SiYuan is a personal knowledge management system.Check if you run itEPSS 0.40%Mar 11, 2026
- Medium5.4The Happy Addons for Elementor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.21.0 via the admin action…Check if you run itEPSS 0.33%Mar 11, 2026
- Medium6.4The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via the and post meta fields in all versions up to, and including, 4.12.3.Check if you run itEPSS 0.36%Mar 11, 2026
- High7.5The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to SQL Injection via the URL path in all versions up to, and including, 4.0.3.Patch nowKEVEPSS 2.33%Mar 11, 2026
- Medium4.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an au…Check if you run itEPSS 0.25%Mar 11, 2026
- High8.8Flowise is a drag & drop user interface to build a customized large language model flow.Check if you run itEPSS 0.39%Mar 10, 2026