Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3Missing Authorization vulnerability in quadlayers AI Copilot ai-copilot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Copilot: fromCheck this weekEPSS 21.00%Dec 31, 2025
- Medium5.4Missing Authorization vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Add CusCheck this weekEPSS 20.00%Dec 31, 2025
- Medium5.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware Locatoraid Store Locator locatoraid allows Stored XSS.This issue affCheck this weekEPSS 21.00%Dec 31, 2025
- Medium5.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Stored XSS.This issue affectCheck this weekEPSS 20.00%Dec 31, 2025
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bainternet User Specific Content user-specific-content allows DOM-Based XSS.ThCheck this weekEPSS 19.00%Dec 31, 2025
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in Zoho Mail Zoho ZeptoMail transmail allows Stored XSS.This issue affects Zoho ZeptoMail: from n/a through <= 3.3.1.Check this weekEPSS 11.00%Dec 31, 2025
- High8.7Gargoyle Authenticated 'run_commands.sh' OS Command ExecutionPatch nowKEVEPSS 0.73%Dec 31, 2025
- Medium5.1ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attackers to inject malicious HTML and JavaScriCheck if you run itEPSS 0.35%Dec 30, 2025
- High8.5Tosibox Key Service 3.3.0 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges.Check if you run itEPSS 0.23%Dec 30, 2025
- Critical9.3Anevia Flamingo XL/XS 3.6.20 contains a critical vulnerability with weak default administrative credentials that can be easily guessed.Check if you run itEPSS 0.65%Dec 30, 2025
- Critical9.3SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an unauthenticated remote code execution vulnerability in the firmware upload functionality with path traversal flaw.Check if you run itEPSS 1.57%Dec 30, 2025
- High8.5SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory.Check if you run itEPSS 4.16%Dec 30, 2025
- Critical9.3SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated command injection vulnerability in the username parameter.Check if you run itEPSS 3.66%Dec 30, 2025
- High8.7SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an authenticated command injection vulnerability in the www-data-handler.php script that allows attackers to inject system commands thrCheck if you run itEPSS 3.13%Dec 30, 2025
- High8.7SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated file disclosure vulnerability that allows remote attackers to access sensitive system files.Check if you run itEPSS 1.57%Dec 30, 2025
- High8.5SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory.Check if you run itEPSS 3.76%Dec 30, 2025
- Medium6.9SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an unauthenticated vulnerability that allows remote attackers to access live radio stream information through webplay oCheck if you run itEPSS 0.79%Dec 30, 2025
- High8.5SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory with .dns.pid eCheck if you run itEPSS 4.20%Dec 30, 2025
- Medium6.9SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive log files.Check if you run itEPSS 0.83%Dec 30, 2025
- Medium5.3SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains an unauthenticated stored cross-site scripting vulnerability in the username parameter that allows attackers to inject maliciousCheck if you run itEPSS 0.44%Dec 30, 2025
- Critical9.3SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain hardcoded credentials embedded in server binaries that cannot be modified through normal device operations.Check if you run itEPSS 0.60%Dec 30, 2025
- High8.7SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x contains a network vulnerability that allows unauthenticated attackers to send ICMP signals to arbitrary hosts through network command scCheck if you run itEPSS 0.80%Dec 30, 2025
- High8.8SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an SQL injection vulnerability in the 'username' POST parameter of index.php that allows attackers to manipulate database queries.Check if you run itEPSS 0.89%Dec 30, 2025
- Medium6.9SOUND4 IMPACT/FIRST/PULSE/Eco versions 2.x and below contain an insufficient session expiration vulnerability that allows attackers to reuse old session credentials.Check if you run itEPSS 0.58%Dec 30, 2025
- High7.1In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix out-of-bounds read When preparing an AER-CTR request, the driver copies the key provided by thCheck if you run itEPSS 0.14%Dec 30, 2025
Sort