Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.1Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/dog/{agentId} endpoint.Check if you run itEPSS 0.20%Dec 5, 2025
- Medium5.1Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devices/name/{agent_id} endpoint.Check if you run itEPSS 0.21%Dec 5, 2025
- Critical9.3ReQuest Serious Play F3 Media Server 7.0.3 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands as the web server useCheck if you run itEPSS 0.72%Dec 5, 2025
- Medium5.1Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/plan endpoint.Check if you run itEPSS 0.21%Dec 5, 2025
- Medium5.1Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/building endpoint.Check if you run itEPSS 0.26%Dec 5, 2025
- Medium5.1Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicegroups/ endpoint.Check if you run itEPSS 0.26%Dec 5, 2025
- Medium5.1Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/schedule endpoint.Check if you run itEPSS 0.25%Dec 5, 2025
- Medium5.1Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/defined endpoint.Check if you run itEPSS 0.26%Dec 5, 2025
- High8.7ReQuest Serious Play F3 Media Server versions 7.0.3.4968 (Pro), 7.0.2.4954, 6.5.2.4954, 6.4.2.4681, 6.3.2.4203, and 2.0.1.823 allows unauthenticated attackers to disclose the webseCheck if you run itEPSS 0.37%Dec 5, 2025
- Medium6.5Nextcloud Calendar is a calendar app for Nextcloud.Check if you run itEPSS 0.29%Dec 5, 2025
- High7.7GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1 that could have allowed an authenticCheck if you run itEPSS 0.25%Dec 5, 2025
- Medium4.9Nextcloud Server is a self hosted personal cloud system.Check if you run itEPSS 0.36%Dec 5, 2025
- Critical9.4Langflow Origin Validation Error VulnerabilityPatch nowKEVEPSS 92.81%Dec 5, 2025
- High8.3XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence.Check if you run itEPSS 0.40%Dec 5, 2025
- High8.9urllib3 is a user-friendly HTTP client library for Python.Check if you run itEPSS 0.68%Dec 5, 2025
- Medium6.9A weakness has been identified in TrippWasTaken PHP-Guitar-Shop up to 6ce0868889617c1975982aae6df8e49555d0d555.Check if you run itEPSS 0.30%Dec 5, 2025
- Medium5.3A vulnerability was identified in Himool ERP up to 2.2.Check if you run itEPSS 0.24%Dec 5, 2025
- Medium5.3A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0.Check if you run itEPSS 0.32%Dec 5, 2025
- Medium5.3A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0.Check if you run itEPSS 0.40%Dec 5, 2025
- High7.5An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0.Check if you run itEPSS 0.45%Dec 5, 2025
- Medium4.4The Trail Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitizCheck if you run itEPSS 0.24%Dec 5, 2025
- Medium6.4The Thai Lottery Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode in all versions up to, and including, 2.5.Check if you run itEPSS 0.28%Dec 5, 2025
- High8.1The My auctions allegro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.32 via the 'controller' parameter.Check if you run itEPSS 0.76%Dec 5, 2025
- Critical9.8The Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification plugin for WordPress is vulnerable to authentication bypass inCheck if you run itEPSS 0.50%Dec 5, 2025
- Medium5.3The Voidek Employee Portal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several AJAX actions in all versions up to, and including,Check if you run itEPSS 0.27%Dec 5, 2025
Sort