Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in all versions up to and including 0.9.14.Check if you run itEPSS 0.34%May 22, 2026
- Medium6.0Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection.Check if you run itEPSS 0.24%May 21, 2026
- Medium5.1Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low…Check if you run itEPSS 0.22%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php.Check if you run itEPSS 0.26%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/ .Check if you run itEPSS 0.19%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group.Check if you run itEPSS 0.47%May 21, 2026
- High7.3Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name.Check if you run itEPSS 0.25%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/ .Check if you run itEPSS 0.16%May 21, 2026
- High8.9Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller.Check if you run itEPSS 0.74%May 21, 2026
- Critical9.4Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts.Check if you run itEPSS 1.11%May 21, 2026
- High8.7LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint.Check if you run itEPSS 0.82%May 21, 2026
- High8.7LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit.Check if you run itEPSS 1.33%May 21, 2026
- Critical9.8The Divi Form Builder plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.1.2.Check if you run itEPSS 0.53%May 21, 2026
- Critical9.9Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an maliciou…Check if you run itEPSS 0.40%May 21, 2026
- High7.2An authentication bypass vulnerability in Netatalk 2.2.2 through 4.4.2 allows a remote privileged user to authenticate as an arbitrary user via the admin auth user mechanism.Check if you run itEPSS 0.73%May 21, 2026
- Medium6.4The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15.2 due t…Check if you run itEPSS 0.34%May 21, 2026
- Medium6.7Trend Micro Apex One (On-Premise) Directory Traversal VulnerabilityPatch nowKEVEPSS 0.54%May 21, 2026
- Medium5.4Mantis Bug Tracker (MantisBT) is an open source issue tracker.Check if you run itEPSS 0.29%May 20, 2026
- High8.4Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a stored cross-site scripting vulnerability in the embedded web configuration interface that allows authe…Check if you run itEPSS 0.47%May 20, 2026
- Critical9.3Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface that allows unauthenti…Check if you run itEPSS 0.71%May 20, 2026
- Critical9.3Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains a hard-coded credential vulnerability in the embedded web configuration interface where authentication is…Check if you run itEPSS 0.67%May 20, 2026
- Medium5.3ArcGIS Server contains an improper authentication vulnerability in an undocumented administrative endpoint.Check if you run itEPSS 0.38%May 20, 2026
- Medium6.5In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.11, and 9.3.12, and Splunk Cloud Platform versions below 10.4.2603.1, 10.3.2512.9, 10.2.2510.11, 10.1.2507.21,…Check if you run itEPSS 0.40%May 20, 2026
- Medium6.5In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data that was restricted thr…Check if you run itEPSS 0.32%May 20, 2026
- Critical10.0A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with t…Check if you run itEPSS 0.83%May 20, 2026