Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.2Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.66%May 15, 2026
- Medium4.3Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.29%May 15, 2026
- High7.3Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.37%May 15, 2026
- High8.1Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.51%May 15, 2026
- Medium6.5Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.44%May 15, 2026
- Medium4.8Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.25%May 15, 2026
- Medium5.4Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.27%May 15, 2026
- High7.6Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.35%May 15, 2026
- High8.1Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.39%May 15, 2026
- High8.7Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.42%May 15, 2026
- High8.1Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.Check if you run itEPSS 0.38%May 15, 2026
- High8.3phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in Utils::parseUrl() that allows authenticated users to inject JavaScript via malformed URLs in comments.Check if you run itEPSS 0.30%May 15, 2026
- Medium5.3phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpoint that allows any authenticated user to delete tags.Check if you run itEPSS 0.30%May 15, 2026
- Critical9.3phpMyFAQ before 4.1.2 contains an unauthenticated SQL injection vulnerability in BuiltinCaptcha::garbageCollector() and BuiltinCaptcha::saveCaptcha() methods that inte…Check if you run itEPSS 2.12%May 15, 2026
- High7.1phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution after s…Check if you run itEPSS 0.51%May 15, 2026
- High8.2phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filt…Check if you run itEPSS 0.34%May 15, 2026
- Critical9.3phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id…Check if you run itEPSS 0.57%May 15, 2026
- Medium5.3phpMyFAQ before 4.1.2 contains an insufficient authorization vulnerability in admin-api routes that allows authenticated ordinary users to access administrative endpoi…Check if you run itEPSS 0.28%May 15, 2026
- High7.0phpMyFAQ before 4.1.2 contains a path traversal vulnerability in Client::deleteClientFolder that allows admins with INSTANCE_DELETE permission to delete arbitrary directories.Check if you run itEPSS 0.48%May 15, 2026
- Medium5.3phpMyFAQ before 4.1.2 contains missing permission checks in ConfigurationTabController.php where 12 endpoints use userIsAuthenticated() instead of userHasPermission(CO…Check if you run itEPSS 0.28%May 15, 2026
- Medium5.3Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high lev…Check if you run itEPSS 0.44%May 15, 2026
- Medium4.3The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1.Check if you run itEPSS 0.20%May 15, 2026
- Medium4.3The Classified Listing – AI-Powered Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to unauthorized access in all versions up to, and inc…Check if you run itEPSS 0.45%May 15, 2026
- Medium4.9The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'table' parameter in all versions up t…Check if you run itEPSS 0.60%May 15, 2026
- High8.8The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36.Patch nowKEVEPSS 0.77%May 15, 2026