Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical10.0A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform pr…Check if you run itEPSS 0.41%Apr 1, 2026
- Medium5.5The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF.Check if you run itEPSS 0.15%Apr 1, 2026
- High8.7XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes.Check if you run itEPSS 0.27%Apr 1, 2026
- High8.2SiYuan is a personal knowledge management system.Check if you run itEPSS 0.36%Mar 31, 2026
- Critical9.0SiYuan is a personal knowledge management system.Check if you run itEPSS 0.73%Mar 31, 2026
- High7.3WWBN AVideo is an open source video platform.Check if you run itEPSS 0.41%Mar 31, 2026
- Medium6.1Captcha Protect is a Traefik middleware to add an anti-bot challenge to individual IPs in a subnet when traffic spikes are detected from that subnet.Check if you run itEPSS 0.33%Mar 31, 2026
- Medium6.5A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation.Check if you run itEPSS 0.39%Mar 31, 2026
- High7.7Out-of-bounds write in the streaming decoder component in aws-c-event-stream before 0.6.0 might allow a third party operating a server to cause memory corruption leadi…Check if you run itEPSS 0.53%Mar 31, 2026
- Medium5.1Discourse is an open-source discussion platform.Check if you run itEPSS 0.34%Mar 31, 2026
- Critical9.1HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java.Check if you run itEPSS 0.20%Mar 31, 2026
- Medium6.1MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients.Check if you run itEPSS 0.31%Mar 31, 2026
- Medium5.9Sliver is a command and control framework that uses a custom Wireguard netstack.Check if you run itEPSS 0.47%Mar 31, 2026
- Medium5.3An incorrect startup configuration of affected versions of Zscaler Client Connector on Windows may cause a limited amount of traffic from being inspected under rare circumstances.Check if you run itEPSS 0.18%Mar 31, 2026
- High8.2Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.Check if you run itEPSS 0.40%Mar 31, 2026
- High7.7Nhost is an open source Firebase alternative with GraphQL.Check if you run itEPSS 0.60%Mar 31, 2026
- Critical9.8DSAI-Cline's command auto-approval module contains a critical OS command injection vulnerability that renders its whitelist security mechanism completely ineffective.Check if you run itEPSS 2.13%Mar 31, 2026
- High7.2The Query Monitor – The developer tools panel for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘$_SERVER['REQUEST_URI']’ para…Check if you run itEPSS 0.40%Mar 31, 2026
- Medium5.4The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12.Check if you run itEPSS 0.18%Mar 31, 2026
- Low2.0OpenClaw before 2026.3.11 contains a credential fallback vulnerability where unavailable local gateway.auth.token and gateway.auth.password SecretRefs are treated as u…Check if you run itEPSS 0.15%Mar 31, 2026
- Critical9.2OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic oper…Check if you run itEPSS 0.63%Mar 31, 2026
- Medium6.5When the early_acl_drop (earlyACLDrop in Lua) option is disabled (default is enabled) on a DNS over HTTPs frontend using the nghttp2 provider, the ACL check is skipped…Check if you run itEPSS 0.15%Mar 31, 2026
- Critical9.3SQL inyection (SQLi) vulnerability in Umami Software web application through an improperly sanitized parameter, which could allow an authenticated attacker to execute…Check if you run itEPSS 0.40%Mar 31, 2026
- Medium6.1The Auto Post Scheduler plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.84.Check if you run itEPSS 0.20%Mar 31, 2026
- Medium6.1The Loco Translate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘update_href’ parameter in all versions up to, and including, 2.8.2 due…Check if you run itEPSS 0.37%Mar 31, 2026