Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- None0.0In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix ECVF vports unload on shutdown flow Fix shutdown flow UAF when a virtual function is created on thCheck this weekEPSS 20.00%Jul 3, 2025
- Medium5.5In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Kill timer properly at removal The USB-audio MIDI code initializes the timer, but in a rare casCheck if you run itEPSS 0.19%Jul 3, 2025
- Medium6.1A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack againstCheck this weekEPSS 29.00%Jul 2, 2025
- Critical9.3A data exfiltration vulnerability exists in Anthropic’s deprecated Slack Model Context Protocol (MCP) Server via automatic link unfurling.Check this weekEPSS 43.00%Jul 2, 2025
- Unknownlb-link bl-ac2100_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')Patch nowKEVEPSS 1.09%Jul 2, 2025
- Medium5.7An information disclosure vulnerability exists in OneLogin AD Connector versions prior to 6.1.5 via the /api/adc/v4/configuration endpoint.Check this weekEPSS 16.00%Jul 1, 2025
- UnknownImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 0.51%Jul 1, 2025
- Medium4.3Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly validate channel membership when retrieving playbookCheck this weekEPSS 20.00%Jun 30, 2025
- Medium5.4Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions when adCheck this weekEPSS 22.00%Jun 30, 2025
- Medium6.5Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is basedCheck this weekEPSS 33.00%Jun 27, 2025
- UnknownImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 2.43%Jun 26, 2025
- UnknownWeaver e-office Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.88%Jun 26, 2025
- Medium4.6Pioneer DMH-WT7600NEX Root Filesystem Insufficient Verification of Data Authenticity Vulnerability.Check this weekEPSS 26.00%Jun 25, 2025
- Medium4.4Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability.Check this weekEPSS 26.00%Jun 25, 2025
- Medium4.5OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys.Check this weekEPSS 33.00%Jun 25, 2025
- High8.0Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Windows Certificate Store oCheck this weekEPSS 19.00%Jun 25, 2025
- Critical10.0Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 15.40%Jun 23, 2025
- UnknownLinksys e1000 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 92.77%Jun 23, 2025
- Unknownengeniustech esr300_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 22.81%Jun 23, 2025
- Unknown5vtechnologies blue_angel_software_suite Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 11.30%Jun 23, 2025
- Medium5.1geoffrowland jmol Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.78%Jun 23, 2025
- Critical9.3A Cross-Site Scripting (XSS) vulnerability has been identified in Psono-Client’s handling of vault entries of type website_password and bookmark, as used in Bitdefender SecurePass.Check this weekEPSS 57.00%Jun 21, 2025
- Medium6.1DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.Check this weekEPSS 23.00%Jun 21, 2025
- Critical9.3rfc3161-client is a Python library implementing the Time-Stamp Protocol (TSP) described in RFC 3161.Check this weekEPSS 17.00%Jun 21, 2025
- Medium4.3In Yealink RPS before 2025-05-26, the certificate upload function does not properly validate certificate content, potentially allowing invalid certificates to be uploaded.Check this weekEPSS 19.00%Jun 21, 2025