Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.8A Reflected Cross-Site Scripting (XSS) vulnerability was discovered in the profile.php file of PHPGurukul Timetable Generator System v1.0.Check if you run itEPSS 0.32%Apr 30, 2025
- Critical9.8Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat.Check if you run itEPSS 4.19%Apr 28, 2025
- Critical10.0IPW Systems Metazo through 8.1.3 allows unauthenticated Remote Code Execution because smartyValidator.php enables the attacker to provide template expressions, aka Server-Side TempCheck if you run itEPSS 0.80%Apr 28, 2025
- Medium5.3A vulnerability was found in Apereo CAS 5.2.6.Check if you run itEPSS 0.64%Apr 27, 2025
- Critical9.1SAP NetWeaver Deserialization VulnerabilityPatch nowKEVEPSS 12.74%Apr 27, 2025
- Medium6.1In IZArc through 4.5, there is a Mark-of-the-Web Bypass Vulnerability.Check if you run itEPSS 0.32%Apr 26, 2025
- High8.8The Vikinger theme for WordPress is vulnerable to privilege in all versions up to, and including, 1.9.30.Check if you run itEPSS 0.38%Apr 25, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bas Matthee LSD Custom taxonomy and category meta custom-taxonomy-category-andCheck if you run itEPSS 0.29%Apr 24, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaloha Dropdown Content dropdown-content allows Stored XSS.This issue affectCheck if you run itEPSS 0.28%Apr 24, 2025
- High8.8The Configurator Theme Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.4.7.Check if you run itEPSS 0.37%Apr 24, 2025
- Medium4.3SAP Field Logistics Manage Logistics application OData meta-data property is vulnerable to data tampering, due to which certain fields could be externally modified by an attacker cCheck if you run itEPSS 0.27%Apr 22, 2025
- Critical10.0SAP NetWeaver Unrestricted File Upload VulnerabilityPatch nowKEVEPSS 99.49%Apr 22, 2025
- UnknownSAP NetWeaver Deserialization of Untrusted DataPatch nowKEVEPSS 5.37%Apr 22, 2025
- Low2.9In LibRaw before 0.21.4, metadata/tiff.cpp has an out-of-bounds read in the Fujifilm 0xf00c tag parser.Check if you run itEPSS 0.44%Apr 20, 2025
- Medium5.4GNU Mailman 2.1.39, as bundled in cPanel (and WHM), in certain external archiver configurations, allows unauthenticated attackers to execute arbitrary OS commands via shell metachaCheck if you run itEPSS 0.59%Apr 20, 2025
- High8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allowsCheck if you run itEPSS 0.34%Apr 17, 2025
- High7.1OpenMetadata <=1.4.1 is vulnerable to SQL Injection.Check this weekEPSS 61.00%Apr 17, 2025
- None0.0In the Linux kernel, the following vulnerability has been resolved: md/raid1,raid10: don't ignore IO flags If blk-wbt is enabled by default, it's found that raid write performanceCheck this weekEPSS 19.00%Apr 16, 2025
- Medium4.3Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of aCheck this weekEPSS 27.00%Apr 16, 2025
- Critical10.0PROLiNK PRC2402M 20190909 before 2021-06-13 allows live_api.cgi?page=satellite_list OS command injection via shell metacharacters in the ip parameter (for satellite_status).Patch nowKEVEPSS 0.99%Mar 25, 2025
- UnknownPorto Porto Theme for WordPress Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')Patch nowKEVEPSS 1.00%Mar 19, 2025
- UnknownImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')Patch nowKEVEPSS 1.54%Mar 19, 2025
- Unknownuser-meta user_meta_user_profile_builder_and_user_management Exposure of Sensitive Information to an Unauthorized ActorPatch nowKEVEPSS 1.12%Mar 11, 2025
- Medium5.5In the Linux kernel, the following vulnerability has been resolved: net: xdp: Disallow attaching device-bound programs in generic mode Device-bound programs are used t…Check if you run itEPSS 0.20%Feb 27, 2025
- High7.1In the Linux kernel, the following vulnerability has been resolved: dm array: fix releasing a faulty array block twice in dm_array_cursor_end When dm_bm_read_lock() fails due to loCheck if you run itEPSS 0.26%Jan 19, 2025