Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.3ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin.Check if you run itEPSS 0.66%Aug 18, 2026
- Critical9.4ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads.Check if you run itEPSS 0.39%Aug 18, 2026
- Low2.3ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers.Check if you run itEPSS 0.21%Aug 18, 2026
- High7.1ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement.Check if you run itEPSS 0.35%Aug 18, 2026
- Medium5.3ArcadeDB versions 26.4.2 through 26.7.3 contain an authorization bypass vulnerability in the set_server_setting MCP server-level tool.Check if you run itEPSS 0.29%Aug 18, 2026
- High7.1ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hos…Check if you run itEPSS 0.32%Aug 18, 2026
- Critical9.4ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute…Check if you run itEPSS 0.38%Aug 18, 2026
- High8.3ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files.Check if you run itEPSS 0.46%Aug 18, 2026
- Medium5.3ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory.Check if you run itEPSS 0.37%Aug 18, 2026
- High8.7ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions…Check if you run itEPSS 0.43%Aug 18, 2026
- Medium5.3ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints (GetClus…Check if you run itEPSS 0.31%Aug 18, 2026
- Medium5.1DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees.Check if you run itEPSS 0.39%Aug 18, 2026
- Critical9.3Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction.Check if you run itEPSS 0.49%Aug 18, 2026
- High8.7The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::…Check if you run itEPSS 0.47%Aug 18, 2026
- Critical9.3Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php).Check if you run itEPSS 0.31%Aug 18, 2026
- Medium5.1Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php).Check if you run itEPSS 0.26%Aug 18, 2026
- High8.6The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::…Check if you run itEPSS 0.22%Aug 18, 2026
- Critical9.3The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in Blueprin…Check if you run itEPSS 0.30%Aug 18, 2026
- Medium5.1Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method.Check if you run itEPSS 0.35%Aug 18, 2026
- High7.1grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method.Check if you run itEPSS 0.39%Aug 18, 2026
- High8.6grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages w…Check if you run itEPSS 0.41%Aug 18, 2026
- Critical9.3Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-han…Check if you run itEPSS 0.39%Aug 18, 2026
- Critical9.3Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a…Check if you run itEPSS 0.86%Aug 18, 2026
- Low2.9A vulnerability was determined in karakeep-app karakeep up to 0.32.0.Check if you run itEPSS 0.58%Aug 18, 2026
- Medium5.1Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates.Check if you run itEPSS 0.24%Aug 18, 2026
Sort