Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on erro…Check if you run itEPSS 0.27%May 14, 2026
- Medium6.9Vvveb before 1.0.8.3 contains a directory listing information disclosure vulnerability that allows unauthenticated attackers to enumerate files and directories by acce…Check if you run itEPSS 0.25%May 14, 2026
- Medium5.3Vvveb before 1.0.8.3 contains a stored cross-site scripting vulnerability in the customer signup flow where the Signup::addUser() controller copies raw POST username v…Check if you run itEPSS 0.22%May 14, 2026
- High7.3Northern.tech CFEngine Enterprise and Community before 3.21.8, 3.24.3, and 3.27.0 allows Command injection.Check if you run itEPSS 0.92%May 14, 2026
- Medium5.3Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 has Incorrect Access Control.Check if you run itEPSS 0.21%May 14, 2026
- Medium6.1Northern.tech CFEngine Enterprise before 3.21.8, 3.24.3, and 3.27.0 allows XSS.Check if you run itEPSS 0.17%May 14, 2026
- Medium5.3Verba is affected by a Stored Cross-Site Scripting (XSS) vulnerability within its login logging mechanism.Check if you run itEPSS 0.21%May 14, 2026
- Medium6.3Remote Code Execution in coleam00 Archon 0.1.0.Check if you run itEPSS 0.31%May 14, 2026
- High7.0Unsafe OpenSSL initialization within some AMD optional tools may allow a local user-privileged attacker to inject a malicious DLL, potentially resulting in arbitrary c…Check if you run itEPSS 0.11%May 14, 2026
- Medium6.0Improper privilege management in the KVM key download component could allow an attacker to swap tokens and download sensitive keys, potentially resulting in unauthoriz…Check if you run itEPSS 0.17%May 14, 2026
- Medium6.3Missing authentication in the KVM key download endpoint could allow an unauthenticated attacker with knowledge of the exposed URL to retrieve sensitive keys, potential…Check if you run itEPSS 0.32%May 14, 2026
- High8.8SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ...Check if you run itEPSS 0.18%May 14, 2026
- High8.8Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database.Check if you run itEPSS 0.37%May 14, 2026
- Medium4.3Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array.Check if you run itEPSS 0.21%May 14, 2026
- High7.5Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service.Check if you run itEPSS 0.60%May 14, 2026
- Medium6.5Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate.Check if you run itEPSS 0.56%May 14, 2026
- High8.8Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the ser…Check if you run itEPSS 0.45%May 14, 2026
- High7.2SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser.Check if you run itEPSS 0.29%May 14, 2026
- High8.8Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g.Check if you run itEPSS 0.41%May 14, 2026
- Medium4.3Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones.Check if you run itEPSS 0.21%May 14, 2026
- High8.8Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds.Check if you run itEPSS 1.01%May 14, 2026
- Medium5.4Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types.Check if you run itEPSS 0.16%May 14, 2026
- Medium5.1WEBCON BPS is vulnerable to Reflected XSS via one of parameters used by "/openinmobileapp" endpoint.Check if you run itEPSS 0.43%May 14, 2026
- High8.8Authorization bypass through User-Controlled key vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc.Check if you run itEPSS 0.30%May 14, 2026
- Medium6.8Authorization bypass through User-Controlled key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd.Check if you run itEPSS 0.22%May 14, 2026
Sort