Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.2SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MARMALADE 2.Check if you run itEPSS 0.17%Dec 11, 2025
- High8.8MaxKB is an open-source AI assistant for enterprise.Check if you run itEPSS 0.35%Dec 11, 2025
- High8.6WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules.Check if you run itEPSS 0.91%Dec 11, 2025
- Medium5.3KodExplorer 4.52 contains an open redirect vulnerability in the user login page that allows attackers to manipulate the 'link' parameter.Check if you run itEPSS 0.32%Dec 11, 2025
- Medium6.9AnyDesk 7.0.15 and 9.0.1 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated SYSTEM privileges.Check if you run itEPSS 0.43%Dec 11, 2025
- High8.6xbtitFM 4.1.18 contains an insecure file upload vulnerability that allows authenticated attackers with administrative privileges to upload and execute arbitrary PHP code through thCheck if you run itEPSS 0.61%Dec 11, 2025
- High8.7xbtitFM 4.1.18 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters.Check if you run itEPSS 1.20%Dec 11, 2025
- High8.7APC Network Management Card 4 contains a path traversal vulnerability that allows unauthenticated attackers to access sensitive system files by manipulating URL parameters.Check if you run itEPSS 0.90%Dec 11, 2025
- High8.7xbtitFM 4.1.18 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by injecting malicious SQL code through the msgidCheck if you run itEPSS 0.58%Dec 11, 2025
- Critical9.3Quick.CMS 6.7 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login authentication by manipulating the login form.Check if you run itEPSS 0.67%Dec 11, 2025
- Critical9.3CSZCMS 1.3.0 contains an authenticated SQL injection vulnerability in the members view functionality that allows authenticated attackers to manipulate database queries.Check if you run itEPSS 0.51%Dec 11, 2025
- High8.7minaliC 2.0.0 contains a denial of service vulnerability that allows remote attackers to crash the web server by sending oversized GET requests.Check if you run itEPSS 0.49%Dec 11, 2025
- Medium5.3SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scrCheck if you run itEPSS 0.31%Dec 11, 2025
- High8.6FoF Pretty Mail 1.1.2 contains a server-side template injection vulnerability that allows administrative users to inject malicious code into email templates.Check if you run itEPSS 0.54%Dec 11, 2025
- Medium6.9FoF Pretty Mail 1.1.2 contains a local file inclusion vulnerability that allows administrative users to include arbitrary server files in email templates.Check if you run itEPSS 0.34%Dec 11, 2025
- Critical9.3Purei CMS 1.0 contains a time-based blind SQL injection vulnerability that allows attackers to manipulate database queries through unfiltered user input parameters.Check if you run itEPSS 0.30%Dec 11, 2025
- High8.7Siklu MultiHaul TG series devices before version 2.0.0 contain an unauthenticated vulnerability that allows remote attackers to retrieve randomly generated credentials via a networCheck if you run itEPSS 0.41%Dec 11, 2025
- High8.8MaxKB is an open-source AI assistant for enterprise.Check if you run itEPSS 0.31%Dec 11, 2025
- Critical9.2Compuware iStrobe Web 20.13 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to upload malicious JSP files through a path traCheck if you run itEPSS 1.00%Dec 11, 2025
- Medium5.3PyroCMS v3.0.1 contains a stored cross-site scripting vulnerability in the admin redirects configuration that allows attackers to inject malicious scripts.Check if you run itEPSS 0.26%Dec 11, 2025
- Medium5.3CE Phoenix v3.0.1 contains a stored cross-site scripting vulnerability in the currencies administration panel that allows attackers to inject malicious scripts.Check if you run itEPSS 0.37%Dec 11, 2025
- High8.6ElkArte Forum 1.1.9 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the theme installation process.Check if you run itEPSS 0.56%Dec 11, 2025
- High8.7FreePBX 16 contains an authenticated remote code execution vulnerability in the API module that allows attackers with valid session credentials to execute arbitrary commands.Check if you run itEPSS 3.57%Dec 11, 2025
- High8.6Akaunting 3.1.8 contains a server-side template injection vulnerability that allows authenticated administrators to execute template expressions in multiple form input fields.Check if you run itEPSS 0.35%Dec 11, 2025
- Medium5.3XMB Forum 1.9.12.06 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript into templates and front page sCheck if you run itEPSS 0.43%Dec 11, 2025
Sort