Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.9Insufficient Verification of Data Authenticity vulnerability in hexpm hex (Hex.RemoteConverger module) allows dependency integrity bypass via unverified lockfile checksums.Check if you run itEPSS 0.19%Apr 30, 2026
- High7.4A flaw was found in gnutls.Check if you run itEPSS 0.56%Apr 30, 2026
- Low3.7A flaw was found in gnutls.Check if you run itEPSS 0.80%Apr 30, 2026
- Medium5.4Multiple authenticated cross-site scripting (XSS) vulnerabilities in the XssHttpServletRequestWrapper class of shopizer v3.2.5 allows attackers to execute arbitrary we…Check if you run itEPSS 0.14%Apr 30, 2026
- High8.8An XML external entity (XXE) vulnerability in the /designer/loadReport endpoint of SpringBlade v4.8.0 allows authenticated attackers to execute arbitrary code via inje…Check if you run itEPSS 0.33%Apr 30, 2026
- Medium6.1A stored cross-site scripting (XSS) vulnerability in the /api/blade-desk/notice/submit endpoint of SpringBlade v4.8.0 allows attackers to execute arbitrary web scripts…Check if you run itEPSS 0.19%Apr 30, 2026
- High8.8An issue in the fileEntityId parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path…Check if you run itEPSS 0.43%Apr 30, 2026
- Medium6.1A stored cross-site scripting (XSS) vulnerability in the /msg/msgInner/save endpoint of JeeSite v5.15.1 allows attackers to execute arbitrary web scripts or HTML via i…Check if you run itEPSS 0.15%Apr 30, 2026
- Critical9.1Gnutls: gnutls: denial of service via dtls zero-length fragmentCheck if you run itEPSS 2.07%Apr 30, 2026
- Critical10.0A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request.Check if you run itEPSS 0.41%Apr 30, 2026
- Medium5.0A Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 allows authenticated attackers to scan internal resources…Check if you run itEPSS 0.17%Apr 30, 2026
- Critical9.6An issue in the fileMd5 parameter in the /a/file/upload endpoint of JeeSite v5.15.1 allows authenticated attackers with file upload permissions to execute a path trave…Check if you run itEPSS 0.38%Apr 30, 2026
- Medium4.3A Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a…Check if you run itEPSS 0.17%Apr 30, 2026
- High8.7CryptPad 2025.3.1 allows unbounded WebSocket frame flood.Check if you run itEPSS 0.58%Apr 30, 2026
- High8.8Improper input validation vulnerability in Progress Software MOVEit Automation allows Privilege Escalation.Check if you run itEPSS 3.32%Apr 30, 2026
- Critical9.8Authentication bypass by primary weakness vulnerability in Progress Software MOVEit Automation allows Authentication Bypass.Check if you run itEPSS 5.04%Apr 30, 2026
- Medium6.1Cross Site Scripting vulnerability in RafyMrX TOKO-ONLINE-ROTI v.1.0 allows a remote attacker to execute arbitrary code via the detail_produk.php componentCheck if you run itEPSS 0.21%Apr 30, 2026
- Medium6.1Cross Site Scripting vulnerability in andrewtch88 mvc-ecommerce v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the produ…Check if you run itEPSS 0.21%Apr 30, 2026
- High8.8A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0.Check if you run itEPSS 0.17%Apr 30, 2026
- Medium6.5A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a c…Check if you run itEPSS 0.21%Apr 30, 2026
- Medium4.3A Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafte…Check if you run itEPSS 0.17%Apr 30, 2026
- Medium5.4A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a craft…Check if you run itEPSS 0.14%Apr 30, 2026
- High8.1An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email functionCheck if you run itEPSS 0.57%Apr 30, 2026
- High8.8Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data External Linking.Check if you run itEPSS 0.21%Apr 30, 2026
- Medium5.4When Keycloak is started with , the Account REST API is only partially disabled.Check if you run itEPSS 0.23%Apr 30, 2026
Sort