Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.2shell-quote's function did not validate object-token inputs against the operator model used by .Check if you run itEPSS 0.79%May 22, 2026
- Medium4.8vifm is vulnerable to a heap buffer overflow during the history merge process when saving the state file (vifminfo.json).Check if you run itEPSS 0.14%May 22, 2026
- Critical9.1Unprotected transport of credentials vulnerability in syslink software AG Avantra on Linux, Windows allows Sniffing Attacks.Check if you run itEPSS 0.19%May 22, 2026
- Medium5.1Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords.Check if you run itEPSS 0.10%May 22, 2026
- High7.5Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows Resource Leak Exposure.Check if you run itEPSS 0.22%May 22, 2026
- Critical9.6Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs (aka Session Replay).Check if you run itEPSS 0.22%May 22, 2026
- High7.5Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability.Check if you run itEPSS 0.13%May 22, 2026
- High7.8Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability.Check if you run itEPSS 0.09%May 22, 2026
- Medium5.5Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability.Check if you run itEPSS 0.10%May 22, 2026
- Medium6.5Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Improper Certificate Validation vulnerability.Check if you run itEPSS 0.08%May 22, 2026
- High8.2Dell PowerFlex Manager, versions 4.6.2 and prior, contains an Open Redirect Vulnerability.Check if you run itEPSS 0.17%May 22, 2026
- Critical9.8An LDAP injection vulnerability in the LDAP Certificate repository of the XKMS server in Apache CXF may allow an attacker to retrieve arbitrary certificates from the repository.Check if you run itEPSS 0.72%May 22, 2026
- Medium5.3Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks.Check if you run itEPSS 0.31%May 22, 2026
- High7.5The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code executio…Check if you run itEPSS 0.66%May 22, 2026
- Medium6.5Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.2, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the TIFF IFD offset in the image heade…Check if you run itEPSS 0.24%May 22, 2026
- High7.5Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to properly validate msgpack-encoded WebSocket frames before memory…Check if you run itEPSS 0.34%May 22, 2026
- High7.5Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to enforce request body size limits on plugin HTTP endpoints which a…Check if you run itEPSS 0.25%May 22, 2026
- Medium4.3Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate user-supplied input in API request handlers which allows…Check if you run itEPSS 0.25%May 22, 2026
- Medium5.3Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to archive the channel before removing persistent notifications whic…Check if you run itEPSS 0.17%May 22, 2026
- Medium4.3Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to sanitize team member data when returned via API to users without…Check if you run itEPSS 0.18%May 22, 2026
- High7.1Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authe…Check if you run itEPSS 0.15%May 22, 2026
- Low2.3STER uses unencrypted TCP traffic to transmit data over the network.Check if you run itEPSS 0.21%May 22, 2026
- Medium5.7Use of a weak password encoding algorithm in STER software allows the value of the password to be guessed after analyzing how passwords with known values are encoded.Check if you run itEPSS 0.10%May 22, 2026
- High8.7A SQL injection vulnerability has been identified in STER.Check if you run itEPSS 0.22%May 22, 2026
- High7.5The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65.Check if you run itEPSS 0.46%May 22, 2026
Sort