Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through t…Check if you run itEPSS 0.33%May 29, 2026
- High8.8Kados R10 GreenBee contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through t…Check if you run itEPSS 0.33%May 29, 2026
- High7.1Navigate CMS 2.8.5 contains a path traversal vulnerability that allows authenticated users to download arbitrary files by injecting directory traversal sequences in th…Check if you run itEPSS 0.56%May 29, 2026
- High7.1MaxOn ERP Software 8.x-9.x contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries through the nomor, user, and jenis…Check if you run itEPSS 0.27%May 29, 2026
- High8.7HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted reque…Check if you run itEPSS 0.33%May 29, 2026
- High8.8HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'desa' POST…Check if you run itEPSS 0.33%May 29, 2026
- High8.8HaPe PKH 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'nama_kelom…Check if you run itEPSS 0.33%May 29, 2026
- Medium6.9HaPe PKH 1.1 contains a cross-site request forgery vulnerability that allows attackers to change administrator passwords by submitting forged requests to the user update endpoint.Check if you run itEPSS 0.18%May 29, 2026
- High8.8E-Registrasi Pencak Silat 18.10 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious c…Check if you run itEPSS 0.33%May 29, 2026
- High8.8Zechat 1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the uname parameter.Check if you run itEPSS 0.33%May 29, 2026
- Critical9.2manga-image-translator contains a remote code execution vulnerability in the shared API server mode due to unsafe deserialization of untrusted pickle data in the share…Check if you run itEPSS 0.62%May 29, 2026
- High8.1n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations.Check if you run itEPSS 0.41%May 29, 2026
- Medium5.3WWBN AVideo is an open source video platform.Check if you run itEPSS 0.32%May 29, 2026
- Medium6.5WWBN AVideo is an open source video platform.Check if you run itEPSS 0.16%May 29, 2026
- Medium6.5n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations.Check if you run itEPSS 0.46%May 29, 2026
- High7.6FreePBX is an open source IP PBX.Check if you run itEPSS 0.49%May 29, 2026
- High8.7An unhandled exception in Suprema BioStar 2 (Server), versions 2.9.8, 2.9.10, and 2.9.11, that allows an unauthenticated remote attacker to cause a denial of service (…Check if you run itEPSS 0.54%May 29, 2026
- Medium6.4A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component.Check if you run itEPSS 0.23%May 29, 2026
- High7.5A flaw was found in the OpenShift Router.Check if you run itEPSS 0.62%May 29, 2026
- Medium6.5A flaw was found in the OpenShift Router.Check if you run itEPSS 0.53%May 29, 2026
- Low2.7A flaw was found in the Quay config-tool's GitLab OAuth validator.Check if you run itEPSS 0.20%May 29, 2026
- High8.1The Media Library Assistant plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.35 This is due to missing nonce verifi…Check if you run itEPSS 0.32%May 29, 2026
- Critical10.0Web endpoints intended for the Acer Connect app improperly validate the HTTP Authorization header, failing to block requests when Base64 decoding fails.Check if you run itEPSS 0.53%May 29, 2026
- Medium4.9The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 3.28.28 du…Check if you run itEPSS 0.29%May 29, 2026
- Critical9.8The OTP Login With Phone Number, OTP Verification plugin for WordPress is vulnerable to authentication bypass in versions 1.8.50 through 1.8.60.Check if you run itEPSS 0.90%May 29, 2026