Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5Concrete CMS 9.5.0 and below does not validate a CSRF token before processing requests to /dashboard/extend/install/download/ .Check if you run itEPSS 0.12%May 21, 2026
- High8.9Concrete CMS 9.5.0 and below is vulnerable to Remote Code Execution due to insecure deserialization occurring in the ExpressEntryList block controller.Check if you run itEPSS 0.47%May 21, 2026
- Critical9.4Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts.Check if you run itEPSS 0.74%May 21, 2026
- Medium6.9Concrete CMS 9.5.0 and below is vulnerable to unauthenticated file usage disclosure via missing permission check in the usage controller.Check if you run itEPSS 1.46%May 21, 2026
- High8.7LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint.Check if you run itEPSS 0.65%May 21, 2026
- High8.7LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit.Check if you run itEPSS 1.19%May 21, 2026
- Medium4.3The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() func…Check if you run itEPSS 0.19%May 21, 2026
- High8.6IINA before 1.4.3 contains a user-assisted command execution vulnerability that allows remote attackers to execute arbitrary commands by supplying malicious mpv_-prefi…Check if you run itEPSS 0.70%May 21, 2026
- High7.5Authen::TOTP versions before 0.1.1 for Perl generate secrets using rand.Check if you run itEPSS 0.42%May 21, 2026
- Critical10.0Ubiquiti UniFi OS Improper Input Validation VulnerabilityPatch nowKEVEPSS 90.03%May 21, 2026
- Critical10.0Ubiquiti UniFi OS Path Traversal VulnerabilityPatch nowKEVEPSS 68.03%May 21, 2026
- Critical10.0Ubiquiti UniFi OS Improper Access Control VulnerabilityPatch nowKEVEPSS 88.29%May 21, 2026
- High8.2Open ISES Tickets before 3.44.2 disables TLS certificate verification in rm/incs/mobile_login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLO…Check if you run itEPSS 0.17%May 21, 2026
- High8.2Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/login.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VER…Check if you run itEPSS 0.21%May 21, 2026
- High8.2Open ISES Tickets before 3.44.2 disables TLS certificate verification in incs/functions.inc.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL…Check if you run itEPSS 0.17%May 21, 2026
- High8.2Open ISES Tickets before 3.44.2 disables TLS certificate verification in ajax/reports.php by setting CURLOPT_SSL_VERIFYPEER to false (and not setting CURLOPT_SSL_VERIF…Check if you run itEPSS 0.17%May 21, 2026
- Medium6.9Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in tables.php that is committed to the public source repository.Check if you run itEPSS 0.22%May 21, 2026
- Medium6.9Open ISES Tickets before 3.44.2 embeds a hardcoded Google Maps API key in settings.inc.php that is committed to the public source repository.Check if you run itEPSS 0.22%May 21, 2026
- Medium6.9Open ISES Tickets before 3.44.2 embeds a hardcoded WhitePages reverse-phone API key in wp1.php that is committed to the public source repository.Check if you run itEPSS 0.22%May 21, 2026
- Critical9.2Open ISES Tickets before 3.44.2 contains hardcoded MySQL database connection credentials (host, username, password, database name) in import_mdb.php.Check if you run itEPSS 0.30%May 21, 2026
- Critical9.2Open ISES Tickets before 3.44.2 contains hardcoded MySQL database credentials in loader.php (a public-facing database utility) that are committed to the source repository.Check if you run itEPSS 0.30%May 21, 2026
- High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/statistics.php where the tick_id and f_tick_id POST parameters are concatenated into WHE…Check if you run itEPSS 0.22%May 21, 2026
- High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/reports.php where the tick_id POST parameter is concatenated into the WHERE clause of SE…Check if you run itEPSS 0.21%May 21, 2026
- High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in ajax/mobile_main.php where the id GET parameter is concatenated into the WHERE clause of a SE…Check if you run itEPSS 0.21%May 21, 2026
- High7.1Open ISES Tickets before 3.44.2 contains a SQL injection vulnerability in message.php where the frm_ticket_id and frm_resp_id POST parameters are concatenated into WHE…Check if you run itEPSS 0.21%May 21, 2026
Sort