Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.6TypeBot is a chatbot builder tool.Check if you run itEPSS 0.41%May 22, 2026
- Critical10.0Typebot is a chatbot builder tool.Check if you run itEPSS 0.45%May 22, 2026
- Medium5.4Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced P…Check if you run itEPSS 0.24%May 22, 2026
- Low3.1Unverified password change in Devolutions Server allows an attacker to change a user's password without providing the previous one via a crafted password change request.Check if you run itEPSS 0.21%May 22, 2026
- Low2.6Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attac…Check if you run itEPSS 0.21%May 22, 2026
- Low2.4Insufficient logging in the entry export feature in Devolutions Server allows an authenticated user with export permissions to export a sealed entry without triggering…Check if you run itEPSS 0.27%May 22, 2026
- Medium4.3Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the do…Check if you run itEPSS 0.25%May 22, 2026
- Medium4.3Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attributes via…Check if you run itEPSS 0.25%May 22, 2026
- Medium4.3Missing authorization in the vault import feature in Devolutions Server 2026.1.16.0 and earlier allows a low-privileged authenticated user to create new vaults via a c…Check if you run itEPSS 0.25%May 22, 2026
- Low2.7Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sea…Check if you run itEPSS 0.30%May 22, 2026
- Medium4.3Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required permissio…Check if you run itEPSS 0.27%May 22, 2026
- Critical9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.Check if you run itEPSS 2.70%May 22, 2026
- High7.5Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to enforce request body size limits on plugin HTTP endpoints which a…Check if you run itEPSS 0.45%May 22, 2026
- Medium4.3Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows…Check if you run itEPSS 0.43%May 22, 2026
- High7.1Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authe…Check if you run itEPSS 0.25%May 22, 2026
- High7.5The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65.Check if you run itEPSS 0.59%May 22, 2026
- Medium5.4The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side…Check if you run itEPSS 0.83%May 22, 2026
- Medium4.3The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3.Check if you run itEPSS 0.20%May 22, 2026
- High8.8The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.5 via…Check if you run itEPSS 0.80%May 22, 2026
- Medium4.3The Alfie – Feed Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1.Check if you run itEPSS 0.19%May 22, 2026
- Critical9.1The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it.Check if you run itEPSS 0.49%May 22, 2026
- Critical9.1When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request.Check if you run itEPSS 0.72%May 22, 2026
- Critical9.1A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.Check if you run itEPSS 0.62%May 22, 2026
- Unknownxiongmaitech uc-httpd Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 28.27%May 22, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion().Check if you run itEPSS 0.17%May 21, 2026