Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3Improper access control in the entry activity log feature in Devolutions Server allows an authenticated user with access to an entry but without the required permissio…Check if you run itEPSS 0.27%May 22, 2026
- Critical9.2NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_rewrite_module module.Check if you run itEPSS 2.70%May 22, 2026
- High7.5Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to enforce request body size limits on plugin HTTP endpoints which a…Check if you run itEPSS 0.45%May 22, 2026
- Medium4.3Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows…Check if you run itEPSS 0.43%May 22, 2026
- High7.1Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authe…Check if you run itEPSS 0.25%May 22, 2026
- High7.5The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65.Check if you run itEPSS 0.59%May 22, 2026
- Medium5.4The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Blind Server-Side…Check if you run itEPSS 0.83%May 22, 2026
- Medium4.3The Widget Context plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.3.Check if you run itEPSS 0.20%May 22, 2026
- High8.8The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.5 via…Check if you run itEPSS 0.80%May 22, 2026
- Medium4.3The Alfie – Feed Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1.Check if you run itEPSS 0.19%May 22, 2026
- Critical9.1The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it.Check if you run itEPSS 0.49%May 22, 2026
- Critical9.1When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request.Check if you run itEPSS 0.72%May 22, 2026
- Critical9.1A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.Check if you run itEPSS 0.62%May 22, 2026
- Unknownxiongmaitech uc-httpd Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 28.27%May 22, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion().Check if you run itEPSS 0.17%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple().Check if you run itEPSS 0.20%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan().Check if you run itEPSS 0.20%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star().Check if you run itEPSS 0.20%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id).Check if you run itEPSS 0.20%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id).Check if you run itEPSS 0.20%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder.Check if you run itEPSS 0.20%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate.Check if you run itEPSS 0.20%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design.Check if you run itEPSS 0.20%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache.Check if you run itEPSS 0.20%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete.Check if you run itEPSS 0.20%May 21, 2026