Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.6External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files…Check if you run itEPSS 0.87%May 12, 2026
- High7.0A race condition in Ivanti Secure Access Client before 22.8R6 allows a locally authenticated user to escalate privileges to SYSTEMCheck if you run itEPSS 0.28%May 12, 2026
- Medium4.4An incorrect permission assignment for critical resource of Ivanti Secure Access Client before 22.8R6 allows a local authenticated user to read or modify sensitive log…Check if you run itEPSS 0.18%May 12, 2026
- High8.2CWE-1188 Initialization of a Resource with an Insecure Default vulnerability exists that could cause unauthorized disclosure of sensitive information when credentials…Check if you run itEPSS 0.29%May 12, 2026
- High8.5Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services.Check if you run itEPSS 0.25%May 12, 2026
- High7.3YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum.Check if you run itEPSS 0.20%May 12, 2026
- High8.1YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum.Check if you run itEPSS 0.28%May 12, 2026
- High8.8YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum.Check if you run itEPSS 0.49%May 12, 2026
- High8.2Open-WebSearch is a multi-engine MCP server, CLI, and local daemon for agent web search and content retrieval.Check if you run itEPSS 0.26%May 12, 2026
- High7.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in elixir-ecto postgrex ('Elixir.Postgrex.Notifications' module) all…Check if you run itEPSS 0.20%May 12, 2026
- Medium5.4A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3.Check if you run itEPSS 0.14%May 12, 2026
- Medium5.3Other issue in the JavaScript Engine component.Check if you run itEPSS 0.30%May 12, 2026
- High7.3Use-after-free in the JavaScript: WebAssembly component.Check if you run itEPSS 0.50%May 12, 2026
- High8.8JIT miscompilation in the JavaScript Engine: JIT component.Check if you run itEPSS 0.42%May 12, 2026
- Medium6.5Incorrect boundary conditions in the JavaScript Engine: JIT component.Check if you run itEPSS 0.24%May 12, 2026
- High7.1CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability that could cause unauthorized access to sensitive files when user-…Check if you run itEPSS 0.30%May 12, 2026
- Critical9.1sealed-env is a cross-stack, zero-trust secret management library for Node.js and Java/Spring Boot.Check if you run itEPSS 0.33%May 12, 2026
- Low2.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.Check if you run itEPSS 0.24%May 12, 2026
- High8.7pam_authnft is a PAM session module binding nftables firewall rules to authenticated sessions via cgroupv2 inodes.Check if you run itEPSS 0.26%May 12, 2026
- Medium4.3An attacker can cause uncontrolled memory usage with excessive bracing over IMAP.Check if you run itEPSS 0.62%May 12, 2026
- Medium6.7Dell PowerScale InsightIQ, versions 5.0.0 through 6.2.0, contains an execution with unnecessary privileges vulnerability.Check if you run itEPSS 0.12%May 12, 2026
- Medium4.3Attacker can use the IMAP SETACL command to inject the anyone permission to user's dovecot-acl file even if imap_acl_allow_anyone=no.Check if you run itEPSS 0.26%May 12, 2026
- Medium6.5Attacker can upload a malicious Sieve script over ManageSieve service (or locally) to bypass configured CPU time limits for Sieve up to 130 times of the configured limit.Check if you run itEPSS 0.34%May 12, 2026
- High8.2Dell PowerScale InsightIQ, versions 6.0.0 through 6.2.0, contains an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability.Check if you run itEPSS 0.46%May 12, 2026
- Medium5.3Attacker can use a specially crafted base64 exchange between Dovecot and Client to fake SCRAM TLS channel binding.Check if you run itEPSS 0.21%May 12, 2026
Sort