Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_f…Check if you run itEPSS 0.70%May 21, 2026
- Medium5.1Catalyst::Plugin::Authentication versions through 0.10024 for Perl is susceptible to timing attacks.Check if you run itEPSS 0.20%May 21, 2026
- Medium5.1Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text.Check if you run itEPSS 0.21%May 21, 2026
- Medium5.1In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline.Check if you run itEPSS 0.17%May 21, 2026
- Medium5.1Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low…Check if you run itEPSS 0.22%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below emits a CSRF token in the local_available_update.php view ($token->output('do_update')) but the corresponding do_update() method in concre…Check if you run itEPSS 0.13%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/prepare_remote_upgrade/ .Check if you run itEPSS 0.17%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below contains a CSRF vulnerability in the install_package() method of concrete/controllers/single_page/dashboard/extend/install.php.Check if you run itEPSS 0.17%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/update/do_update/ .Check if you run itEPSS 0.12%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group.Check if you run itEPSS 0.30%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to authorization bypass in the Calendar Block since action_get_events does not check canView on the calendar which results i…Check if you run itEPSS 0.21%May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure.Check if you run itEPSS 0.21%May 21, 2026
- High7.3Concrete CMS 9.5.0 and below has Stored XSS on the height parameter.Check if you run itEPSS 0.12%May 21, 2026
- High7.3Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name.Check if you run itEPSS 0.18%May 21, 2026
- High7.5Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/ .Check if you run itEPSS 0.12%May 21, 2026
- High8.9Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller.Check if you run itEPSS 0.47%May 21, 2026
- Critical9.4Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts.Check if you run itEPSS 0.74%May 21, 2026
- Medium6.9Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller.Check if you run itEPSS 1.46%May 21, 2026
- High8.7LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint.Check if you run itEPSS 0.65%May 21, 2026
- High8.7LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit.Check if you run itEPSS 1.19%May 21, 2026
- Medium4.3The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() func…Check if you run itEPSS 0.19%May 21, 2026
- High8.6IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefi…Check if you run itEPSS 0.70%May 21, 2026
- High7.5Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand.Check if you run itEPSS 0.42%May 21, 2026
- Critical10.0Ubiquiti UniFi OS Improper Input Validation VulnerabilityPatch nowKEVEPSS 90.03%May 21, 2026
- Critical10.0Ubiquiti UniFi OS Path Traversal VulnerabilityPatch nowKEVEPSS 68.03%May 21, 2026
Sort