Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.8A weakness has been identified in GNU Binutils 2.45.Check if you run itEPSS 0.28%Oct 16, 2025
- Medium6.1Mattermost Desktop App versions <=5.13.0 fail to manage modals in the Mattermost Desktop App that stops a user with a server that uses basic authentication from accessing their serCheck if you run itEPSS 0.32%Oct 16, 2025
- Medium4.3STOMP over WebSocket applications may be vulnerable to a security bypass that allows an attacker to send unauthorized messages.Check if you run itEPSS 0.31%Oct 16, 2025
- Medium5.1An Exposure of Private Personal Information ('Privacy Violation') vulnerability [CWE-359] in Fortinet FortiDLP Agent's Outlookproxy plugin for MacOS and Windows 11.5.1 and 11.4.2 tCheck if you run itEPSS 0.18%Oct 16, 2025
- Critical9.6An improper access control vulnerability exists in multiple WSO2 products due to insufficient permission enforcement in certain internal SOAP Admin Services and System REST APIs.Check if you run itEPSS 0.56%Oct 16, 2025
- Medium5.7An improper access control vulnerability exists in WSO2 Enterprise Integrator product due to insufficient permission restrictions on internal SOAP admin services related to systemCheck if you run itEPSS 0.21%Oct 16, 2025
- Critical9.8Due to an insufficient access control implementation in multiple WSO2 Products, authentication and authorization checks for certain REST APIs can be bypassed, allowing them to be iCheck if you run itEPSS 0.82%Oct 16, 2025
- Medium5.3desknet's NEO V4.0R1.0 to V9.0R2.0 contains a hard-coded cryptographic key, which allows an attacker to create malicious AppSuite applications.Check if you run itEPSS 0.27%Oct 16, 2025
- Medium5.3ChatLuck contains a cross-site scripting vulnerability in Guest User Sign-up.Check if you run itEPSS 0.27%Oct 16, 2025
- Medium6.9ChatLuck contains an insufficient granularity of access control vulnerability in Invitation of Guest Users.Check if you run itEPSS 0.33%Oct 16, 2025
- Medium4.8ChatLuck contains a cross-site scripting vulnerability in Chat Rooms.Check if you run itEPSS 0.24%Oct 16, 2025
- High8.1Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which aCheck if you run itEPSS 0.42%Oct 16, 2025
- High7.5** UNSUPPORTED WHEN ASSIGNED ** Inefficient Regular Expression Complexity vulnerability in Apache Traffic Control.Check if you run itEPSS 0.74%Oct 16, 2025
- Medium5.4Mattermost versions 10.10.x <= 10.10.2, 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to validate email ownership during Slack import process which allows attackers to create verifiedCheck if you run itEPSS 0.30%Oct 16, 2025
- Medium6.5HCL BigFix Mobile 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP).Check if you run itEPSS 0.30%Oct 16, 2025
- Critical9.8A Deserialization of Untrusted Data vulnerability exists in the Apache ActiveMQ NMS AMQP Client.Check if you run itEPSS 2.09%Oct 16, 2025
- Medium6.5HCL BigFix Modern Client Management (MCM) 3.3 and earlier are vulnerable to certain insecure directives within the Content Security Policy (CSP).Check if you run itEPSS 0.30%Oct 16, 2025
- Low3.1Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to properly validate guest user permissions when adding channel members which allows guest users to add any team membCheck if you run itEPSS 0.33%Oct 16, 2025
- High8.1Mattermost versions 10.11.x <= 10.11.1, 10.10.x <= 10.10.2, 10.5.x <= 10.5.10 fail to verify a user has permission to join a Mattermost team using the original invite token which aCheck if you run itEPSS 0.34%Oct 16, 2025
- Low3.1Mattermost versions 10.5.x <= 10.5.10, 10.11.x <= 10.11.2 fail to use constant-time comparison for sensitive string comparisons which allows attackers to exploit timing oracles toCheck if you run itEPSS 0.27%Oct 16, 2025
- Medium5.1Stored Cross-Site Scripting (XSS) in Sergestec's Exito v8.0, consisting of a stored XSS due to a lack of proper validation of user input by sending a POST request using the 'obs' pCheck if you run itEPSS 0.27%Oct 16, 2025
- Critical9.3SQL injection in Sergestec's SISTICK v7.2.Check if you run itEPSS 0.38%Oct 16, 2025
- Critical9.8The Truelysell Core plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.8.6.Check if you run itEPSS 0.54%Oct 16, 2025
- Medium6.4The Ultimate Addons for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to 3.21.1 (exclusive) due to insufficient input sanitization aCheck if you run itEPSS 0.29%Oct 16, 2025
- High7.1A Host Header Injection vulnerability exists in the password reset functionality of CraftMyCMS 4.0.2.2.Check if you run itEPSS 0.31%Oct 16, 2025
Sort