Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.1UVdesk core-framework before 1.1.7 contains a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfig…Check if you run itEPSS 0.32%Sep 21, 2026
- Low2.1A vulnerability was determined in ST Engineering iDirect iDX and Evo iDX.Check if you run itEPSS 0.45%Sep 21, 2026
- Low2.1A vulnerability was found in ST Engineering iDirect iDX and Evo iDX.Check if you run itEPSS 0.43%Sep 21, 2026
- Critical9.1UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwarded-Proto and X-Forwarded-Pr…Check if you run itEPSS 0.33%Sep 21, 2026
- Medium6.5givewp givewp Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Patch nowKEVEPSS 0.31%Sep 21, 2026
- Unknownincsub forminator Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 0.73%Sep 21, 2026
- UnknownImproper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 1.42%Sep 21, 2026
- UnknownUnrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.45%Sep 21, 2026
- UnknownThemefic ultimate_addons_for_contact_form_7 Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 4.33%Sep 21, 2026
- Unknowniguazio nuclio Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 7.52%Sep 21, 2026
- UnknownFlowiseAI Flowise Use of Hard-coded Cryptographic KeyPatch nowKEVEPSS 0.66%Sep 21, 2026
- UnknownImproper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')Patch nowKEVEPSS 1.16%Sep 21, 2026
- UnknownCVE-2026-89155Open the advisorySep 19, 2026
- High7.5Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted.Check if you run itEPSS 0.40%Sep 19, 2026
- Low2.3hono/jsx before 4.13.7 Cross-Site Scripting via Unescaped StringsCheck if you run itEPSS 0.23%Sep 19, 2026
- Low3.5The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per…Check if you run itEPSS 0.24%Sep 19, 2026
- Critical9.3A flaw was found in the OpenShift console.Check if you run itEPSS 0.73%Sep 18, 2026
- UnknownIn Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL.Check if you run itEPSS 0.36%Sep 18, 2026
- Medium6.5A flaw was found in Netty's component.Check if you run itEPSS 1.35%Sep 18, 2026
- Medium6.5A flaw was found in Netty's HTTP/1 decoder.Check if you run itEPSS 0.41%Sep 18, 2026
- Medium6.1A flaw was found in the Quarkus Qute template engine.Check if you run itEPSS 0.54%Sep 18, 2026
- Medium5.5A flaw was found in cockpit-machines.Check if you run itEPSS 0.17%Sep 18, 2026
- Medium5.0A flaw was found in .Check if you run itEPSS 0.17%Sep 18, 2026
- Medium5.0A flaw was found in cockpit-machines.Check if you run itEPSS 0.11%Sep 18, 2026
- High7.4PJSIP is a free and open source multimedia communication library written in C.Check if you run itEPSS 0.23%Sep 18, 2026
Sort