Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.9Affected systems do not properly restrict access to internal APIs and paths for authenticated users.Check if you run itEPSS 0.46%Oct 13, 2026
- High8.8A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions…Check if you run itEPSS 0.46%Oct 13, 2026
- Unknownpyjwt vulnerabilitiesOpen the advisoryOct 13, 2026
- High8.8Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution VulnerabilityCheck if you run itEPSS 0.80%Oct 13, 2026
- High8.8Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution VulnerabilityCheck if you run itEPSS 1.27%Oct 13, 2026
- UnknownImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 1.56%Oct 13, 2026
- Unknownweplugins wp_maps Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 0.53%Oct 13, 2026
- UnknownImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 0.29%Oct 13, 2026
- UnknownMissing AuthorizationPatch nowKEVEPSS 0.71%Oct 13, 2026
- UnknownUnrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.37%Oct 13, 2026
- UnknownStellarWP the_events_calendar Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 2.08%Oct 13, 2026
- Unknownwpfastestcache wp_fastest_cache Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 73.71%Oct 13, 2026
- High8.4Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by up…Check if you run itEPSS 0.26%Oct 12, 2026
- Medium6.9ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when…Check if you run itEPSS 0.30%Oct 12, 2026
- Medium6.5Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities.Check if you run itEPSS 0.27%Oct 12, 2026
- Low3.1A flaw was found in Quay.Check if you run itEPSS 0.15%Oct 12, 2026
- Medium5.4Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions.Check if you run itEPSS 0.39%Oct 12, 2026
- Low2.0ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing confi…Check if you run itEPSS 0.11%Oct 12, 2026
- Critical9.4Authentication Bypass via Spoofed Remote-User Header in HTTP Basic AuthenticationCheck if you run itEPSS 0.39%Oct 12, 2026
- Low2.3OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile…Check if you run itEPSS 0.20%Oct 10, 2026
- UnknownExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list.Check if you run itEPSS 0.38%Oct 10, 2026
- UnknownExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument.Check if you run itEPSS 0.40%Oct 10, 2026
- UnknownExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list.Check if you run itEPSS 0.18%Oct 10, 2026
- Criticaltheme-fusion avada_builder Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 0.43%Oct 9, 2026
- UnknownCVE-2026-94439 affecting package golang 1.27.1-1Open the advisoryOct 8, 2026