Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated…Check if you run itEPSS 0.30%Oct 12, 2026
- Medium5.3Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a server-side request forgery vulnerability caused by a configuration field, writable by common operati…Check if you run itEPSS 0.20%Oct 12, 2026
- High7.2Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking endpoints lacking proper aut…Open the advisoryOct 12, 2026
- Medium5.1Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform.Check if you run itEPSS 0.24%Oct 12, 2026
- Medium5.7Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities.Check if you run itEPSS 0.13%Oct 12, 2026
- High8.8Nginx UI is a web user interface for the Nginx web server.Check if you run itEPSS 0.43%Oct 12, 2026
- High8.7IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image r…Check if you run itEPSS 0.23%Oct 12, 2026
- Medium6.5IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper input validation due to an unsanitised container image c…Check if you run itEPSS 0.23%Oct 12, 2026
- High8.7IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to command injection due to improper sanitisation of a user-controll…Check if you run itEPSS 0.67%Oct 12, 2026
- High8.6Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows users with the edit users…Check if you run itEPSS 0.33%Oct 12, 2026
- Medium6.3Nginx UI: Auto backup name allows path traversal outside validated storage pathCheck if you run itEPSS 0.17%Oct 12, 2026
- Medium4.3Backstage: Improper access control in backend action invocationCheck if you run itEPSS 0.24%Oct 12, 2026
- High8.3Nginx UI OTP secure-session step-up is missing on sensitive mutation routesCheck if you run itEPSS 0.22%Oct 12, 2026
- Critical9.1A flaw was found in Quarkus REST Data Panache.Check if you run itEPSS 0.39%Oct 12, 2026
- High7.4A flaw was found in openstack-network-exporter.Check if you run itEPSS 0.28%Oct 12, 2026
- Low2.1A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2.Check if you run itEPSS 0.27%Oct 12, 2026
- High7.1Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which…Check if you run itEPSS 0.10%Oct 12, 2026
- High8.7Craft CMS from 5.10.2 before 5.10.14 contains a Twig sandbox bypass that allows non-admin users to invoke PHP callables through the "has some" and "has every" operators.Check if you run itEPSS 0.48%Oct 12, 2026
- Medium4.8ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an al…Check if you run itEPSS 0.12%Oct 12, 2026
- Low2.0ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation.Check if you run itEPSS 0.11%Oct 12, 2026
- Medium4.8ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling.Check if you run itEPSS 0.13%Oct 12, 2026
- Medium6.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails.Check if you run itEPSS 0.37%Oct 12, 2026
- Critical9.6Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perfo…Check if you run itEPSS 0.31%Oct 12, 2026
- Critical9.9Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations.Check if you run itEPSS 0.35%Oct 12, 2026
- Medium6.3Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted QueriesCheck if you run itEPSS 0.22%Oct 12, 2026