Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.6Cleartext Transmission of Sensitive Information (CWE-319) in a component used in the Gallagher Hanwha VMS and Gallagher NxWitness VMS integrations allows unprivileged…Check if you run itEPSS 0.10%Mar 3, 2026
- High8.2Apache::SessionX versions through 2.01 for Perl create insecure session id.Check if you run itEPSS 0.21%Feb 27, 2026
- High8.7TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32.Check if you run itEPSS 0.84%Feb 26, 2026
- High8.7TinyWeb is a web server (HTTP, HTTPS) written in Delphi for Win32.Check if you run itEPSS 0.84%Feb 26, 2026
- Medium4.4A vulnerability in the NX-OS CLI privilege levels of Cisco UCS Manager Software could allow an authenticated, local attacker with read-only privileges to modify files…Check if you run itEPSS 0.10%Feb 25, 2026
- High7.4A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco NX-OS Software could allow an unauthenticated, adjacent attacker to cause the LLDP process…Check if you run itEPSS 0.17%Feb 25, 2026
- Medium5.4OpenEMR is a free and open source electronic health records and medical practice management application.Check if you run itEPSS 3.75%Feb 25, 2026
- High8.0TOTOLink X5000R v9.1.0cu_2415_B20250515 contains an OS command injection vulnerability in the setIptvCfg handler of the /usr/sbin/lighttpd executable.Check if you run itEPSS 3.16%Feb 23, 2026
- Unknowningress-nginx auth-proxy-set-headers nginx configuration injectionCheck if you run itEPSS 0.53%Feb 6, 2026
- Unknowningress-nginx Admission Controller denial of serviceCheck if you run itEPSS 0.52%Feb 2, 2026
- Unknowningress-nginx auth-url protection bypassCheck if you run itEPSS 0.34%Feb 2, 2026
- Unknowningress-nginx rules.http.paths.path nginx configuration injectionCheck if you run itEPSS 0.56%Feb 2, 2026
- Unknowningress-nginx auth-method nginx configuration injectionCheck if you run itEPSS 0.54%Feb 2, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: backlight: led-bl: Add devlink to supplier LEDs LED Backlight is a consumer of one or multiple LED…Check if you run itEPSS 0.20%Jan 5, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Prevent handling any completions after qp destroy HW may generate completions that in…Check if you run itEPSS 0.20%Dec 24, 2025
- UnknownIn the Linux kernel, the following vulnerability has been resolved: pinctrl: s32cc: fix uninitialized memory in s32_pinctrl_desc s32_pinctrl_desc is allocated with dev…Check if you run itEPSS 0.21%Dec 16, 2025
- UnknownIn the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix null pointer dereference in bnxt_bs_trace_check_wrap() With older FW, we may get the A…Check if you run itEPSS 0.18%Dec 16, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix streaming cleanup on release The current implementation unconditionally c…Check if you run itEPSS 0.15%Dec 16, 2025
- Unknownlynxtechnology twonky_server Unprotected Alternate ChannelPatch nowKEVEPSS 32.53%Dec 15, 2025
- UnknownIn the Linux kernel, the following vulnerability has been resolved: bnxt_en: Shutdown FW DMA in bnxt_shutdown() The netif_close() call in bnxt_shutdown() only stops packet DMA.Check if you run itEPSS 0.22%Dec 9, 2025
- Medium5.9Traefik is an HTTP reverse proxy and load balancer.Check if you run itEPSS 0.22%Dec 9, 2025
- Medium5.3The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and including, 0.25.9.Open the advisoryDec 4, 2025
- Medium6.4The Nexter Extension – Site Enhancements Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'nxt-year' shortcode in all version…Open the advisoryDec 2, 2025
- High8.1The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0.Open the advisoryDec 2, 2025
- Critical9.2General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to remotely reset the device.Open the advisoryNov 15, 2025