Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.6The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::…Check if you run itEPSS 0.22%Aug 18, 2026
- Critical9.3The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in Blueprin…Check if you run itEPSS 0.30%Aug 18, 2026
- Medium5.1Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method.Check if you run itEPSS 0.35%Aug 18, 2026
- High7.1grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method.Check if you run itEPSS 0.39%Aug 18, 2026
- High8.6grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages w…Check if you run itEPSS 0.41%Aug 18, 2026
- Critical9.3Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-han…Check if you run itEPSS 0.39%Aug 18, 2026
- Critical9.3Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a…Check if you run itEPSS 0.86%Aug 18, 2026
- Low2.9A vulnerability was determined in karakeep-app karakeep up to 0.32.0.Check if you run itEPSS 0.58%Aug 18, 2026
- Medium5.1Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates.Check if you run itEPSS 0.24%Aug 18, 2026
- Medium5.1Grav plugin-api before 1.0.15 contains a script injection vulnerability where the SVG sanitizer only checks for the exact extension 'svg', allowing .svgz and .xhtml fi…Check if you run itEPSS 0.26%Aug 18, 2026
- High8.2Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation.Check if you run itEPSS 0.43%Aug 18, 2026
- High8.7SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list inst…Check if you run itEPSS 0.38%Aug 18, 2026
- Medium6.9SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce S…Check if you run itEPSS 0.39%Aug 18, 2026
- High8.7SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb).Check if you run itEPSS 0.45%Aug 18, 2026
- Medium5.3SiYuan before v3.7.4 contains an insufficient access control vulnerability in the /api/lute/spinBlockDOM endpoint, which is guarded only by CheckAuth middleware instea…Check if you run itEPSS 0.25%Aug 18, 2026
- Critical9.3SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML vi…Check if you run itEPSS 0.20%Aug 18, 2026
- Medium5.7Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade Inc.Check if you run itEPSS 0.17%Aug 18, 2026
- High7.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd.Check if you run itEPSS 0.50%Aug 18, 2026
- Low2.9A vulnerability was found in karakeep-app karakeep up to 0.32.0.Check if you run itEPSS 0.65%Aug 18, 2026
- Critical9.3Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing…Check if you run itEPSS 0.84%Aug 18, 2026
- Critical9.3SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata.Check if you run itEPSS 0.33%Aug 18, 2026
- Medium5.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informatics Services Trade Inc.Check if you run itEPSS 0.23%Aug 18, 2026
- Medium6.3Improper Encoding or Escaping of Output vulnerability in ninenines cowlib allows Link header directive smuggling via unescaped special characters in cow_link:link/1.Check if you run itEPSS 0.52%Aug 18, 2026
- Critical9.8SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP.Check if you run itEPSS 0.69%Aug 18, 2026
- High8.1Velociraptor's web GUI allows specifying a custom type for columns in tables.Check if you run itEPSS 0.37%Aug 18, 2026
Sort