Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.0The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when successfully exploited could allow a local user to escalate theiCheck this weekEPSS 12.00%Aug 7, 2025
- Medium5.3Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Microsoft Windows environmeCheck this weekEPSS 22.00%Aug 7, 2025
- Medium6.5MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed.Open the advisoryAug 6, 2025
- Medium5.9Windows Shortcut Following (.LNK) vulnerability in multiple processes of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.Check this weekEPSS 20.00%Aug 6, 2025
- Critical9.3FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbitrary files to sensitive system directories.Check if you run itEPSS 2.23%Aug 5, 2025
- UnknownExposed IOCTL with Insufficient Access ControlPatch nowKEVEPSS 8.01%Aug 5, 2025
- Medium6.5An issue was discovered in CPUID cpuz.sys 1.0.5.4.Check this weekEPSS 28.00%Aug 5, 2025
- UnknownMicrosoft Windows Improper Input ValidationPatch nowKEVEPSS 5.97%Aug 4, 2025
- Critical9.3An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote attackers to upload arbitrary files to the server’s filesystCheck if you run itEPSS 1.49%Aug 1, 2025
- UnknownMicrosoft Windows Untrusted Pointer DereferencePatch nowKEVEPSS 1.98%Aug 1, 2025
- High8.7A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin.Check if you run itEPSS 2.15%Jul 31, 2025
- Medium4.4LsiAgent.exe, a component of SysTrack from Lakeside Software, attempts to load several DLL files which are not present in the default installation.Check this weekEPSS 18.00%Jul 27, 2025
- High8.7A path traversal vulnerability exists in httpdasm version 0.92, a lightweight Windows HTTP server, that allows unauthenticated attackers to read arbitrary files on the host system.Check if you run itEPSS 2.07%Jul 23, 2025
- UnknownVM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not overrideCheck if you run itEPSS 0.38%Jul 21, 2025
- High7.5Prettier eslint-config-prettier Embedded Malicious Code VulnerabilityPatch nowKEVEPSS 4.93%Jul 19, 2025
- High7.5An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like CON, PRN, and AUX.Check this weekEPSS 14.34%Jul 18, 2025
- High8.7A path traversal vulnerability exists in RIPS Scanner version 0.54.Check if you run itEPSS 2.47%Jul 16, 2025
- High8.4A buffer overflow vulnerability exists in PDF Shaper versions 3.5 and 3.6 when converting a crafted PDF file to an image using the 'Convert PDF to Image' functionality.Check this weekEPSS 45.00%Jul 15, 2025
- Critical10.0A stack-based buffer overflow vulnerability exists in the built-in web interface of DiskBoss Enterprise versions 7.4.28, 7.5.12, and 8.2.14.Check if you run itEPSS 1.67%Jul 15, 2025
- Critical9.3A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or write arbitrary files outside the configurCheck if you run itEPSS 1.93%Jul 15, 2025
- High8.7BatchSignCS, a background Windows application developed by WellChoose, has an Arbitrary File Write vulnerability.Check this weekEPSS 89.00%Jul 14, 2025
- Medium6.8Installation file of ESET security products on Windows allow an attacker to misuse to delete an arbitrary file without having the permissions to do so.Check this weekEPSS 15.00%Jul 11, 2025
- Critical9.3An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint.Check if you run itEPSS 6.22%Jul 10, 2025
- Critical9.3An unauthenticated command injection vulnerability exists in Serviio Media Server versions 1.4 through 1.8 on Windows, in the /rest/action API endpoint exposed by the console compoCheck if you run itEPSS 4.36%Jul 10, 2025
- Medium6.5Classic buffer overflow in certain Zoom Clients for Windows may allow an authorized user to conduct a denial of service via network access.Check this weekEPSS 55.00%Jul 10, 2025