Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to ex…Check if you run itEPSS 0.95%May 6, 2026
- Medium6.9Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggerin…Check if you run itEPSS 0.42%May 6, 2026
- Critical9.2Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to a…Check if you run itEPSS 0.64%May 6, 2026
- High7.5Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6.Check if you run itEPSS 2.08%May 6, 2026
- Medium4.3A vulnerability in the RADIUS Policy API endpoints of Cisco ISE could allow an authenticated, remote attacker with read-only Administrator privileges to gain unauthori…Check if you run itEPSS 0.22%May 6, 2026
- Medium6.4The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.5.0.Check if you run itEPSS 0.45%May 6, 2026
- Medium4.9The Fluent Forms plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 6.2.1.Check if you run itEPSS 0.83%May 6, 2026
- High7.3An authenticated (non-super) administrator can create a maintenance period with a JavaScript payload that is executed by any user that opens tooltip for that maintenan…Check if you run itEPSS 0.26%May 6, 2026
- Medium6.5The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83.Check if you run itEPSS 0.35%May 6, 2026
- High8.8Quarkus is a Java framework for building cloud-native applications.Check if you run itEPSS 0.63%May 5, 2026
- High8.7Pi-hole FTL is the core engine of the Pi-hole network-level advertisement and tracker blocker.Check if you run itEPSS 1.00%May 5, 2026
- Critical9.3Masa CMS is an open source content management system.Check if you run itEPSS 0.54%May 5, 2026
- Critical9.3Masa CMS is an open source content management system.Check if you run itEPSS 0.51%May 5, 2026
- Critical9.3Sandboxie-Plus is an open source sandbox-based isolation software for Windows.Check if you run itEPSS 0.29%May 5, 2026
- Medium5.3FacturaScripts is an open source accounting and invoicing software.Check if you run itEPSS 0.41%May 5, 2026
- High8.2Sandboxie is an open source sandbox-based isolation software for Windows.Check if you run itEPSS 0.16%May 5, 2026
- Critical9.8OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables.Patch nowKEVEPSS 4.68%May 5, 2026
- Critical9.8OpenCMS v20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user supplied .zip files containing a manifest.xml.Check if you run itEPSS 0.54%May 5, 2026
- Medium6.5Traccar is an open source GPS tracking system.Check if you run itEPSS 0.35%May 5, 2026
- High7.1OpenClaw versions 2026.4.5 before 2026.4.10 contain a privilege escalation vulnerability allowing write-scoped operators to modify persistent memory dreaming settings.Check if you run itEPSS 0.38%May 5, 2026
- High7.1OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admi…Check if you run itEPSS 0.41%May 5, 2026
- Medium5.9An issue was discovered in the PaperCut Hive Ricoh embedded application.Check if you run itEPSS 0.41%May 5, 2026
- Medium4.6An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4).Check if you run itEPSS 0.56%May 5, 2026
- Medium6.4The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Instagram Feed widget's 'instagram_follow_text' setting in all…Check if you run itEPSS 0.36%May 5, 2026
- Medium6.1The Publish 2 Ping.fm plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.Check if you run itEPSS 0.18%May 5, 2026