Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.1Insufficient ownership check in allows an authenticated client area user to submit requests using another user’s without any ownership validation leading to unauthoriz…Check if you run itEPSS 0.45%May 12, 2026
- Critical9.8A missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox Cloud 5.0.2 through 5.0.5, FortiSand…Check if you run itEPSS 0.50%May 12, 2026
- Medium6.5An improper neutralization of argument delimiters in a command ('argument injection') vulnerability in Fortinet FortiDeceptor 6.0.0 through 6.0.2, FortiDeceptor 5.3.0…Check if you run itEPSS 0.33%May 12, 2026
- High8.8An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiNDR 7.6.0 through 7.6.2, FortiNDR 7.4.0 through…Check if you run itEPSS 0.26%May 12, 2026
- Medium5.3A use of potentially dangerous function vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.8, FortiAnalyzer 7.2 all versions,…Check if you run itEPSS 0.42%May 12, 2026
- High7.2An improper neutralization of special elements used in an SQL Command ("SQL Injection&") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3…Check if you run itEPSS 0.36%May 12, 2026
- Medium6.7An improper neutralization of special elements used in an OS command ("OS Command Injection") vulnerability [CWE-78] vulnerability in Fortinet FortiAP 7.6.0 through 7.…Check if you run itEPSS 0.56%May 12, 2026
- Medium4.3Missing authorization in the PAM module in Devolutions Server allows an authenticated user with a PAM license but no additional permissions to obtain OTP secret keys a…Check if you run itEPSS 0.27%May 12, 2026
- Critical9.1The nexent v1.7.5.2 backend service contains an unauthorized arbitrary storage file deletion vulnerability in its file management API.Check if you run itEPSS 0.71%May 12, 2026
- Critical9.1The nexent v1.7.5.2 backend service contains an unauthorized arbitrary file deletion vulnerability in its ElasticSearch service interface.Check if you run itEPSS 0.73%May 12, 2026
- High7.1Server-Side Request Forgery vulnerability allows Privilege Escalation via API Checker extension.Check if you run itEPSS 0.42%May 12, 2026
- High7.1Cross-Site Request Forgery vulnerability allows an attacker to perform unauthorized actions via crafted web page.Check if you run itEPSS 0.18%May 12, 2026
- Medium5.4An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation of the chamado parameter th…Check if you run itEPSS 0.17%May 12, 2026
- Medium6.5LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects.Check if you run itEPSS 0.41%May 12, 2026
- High8.1YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum.Check if you run itEPSS 0.38%May 12, 2026
- Low2.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.Check if you run itEPSS 0.30%May 12, 2026
- High7.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception.Check if you run itEPSS 0.58%May 12, 2026
- High7.5multiparty@4.2.3 and lower versions are vulnerable to denial of service via uncaught exception.Check if you run itEPSS 0.53%May 12, 2026
- High8.7The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests.Check if you run itEPSS 0.32%May 12, 2026
- Medium4.3The Zawgyi Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1.Check if you run itEPSS 0.19%May 12, 2026
- Medium4.3The WP-Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.3.Check if you run itEPSS 0.20%May 12, 2026
- Medium6.1The Tm – WordPress Redirection plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.Check if you run itEPSS 0.18%May 12, 2026
- Medium4.3The Woo Commerce Minimum Weight plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.0.1.Check if you run itEPSS 0.20%May 12, 2026
- Medium4.3The Skysa Text Ticker App plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.Check if you run itEPSS 0.19%May 12, 2026
- Medium4.3The Coinbase Commerce for Contact Form 7 plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.1.2.Check if you run itEPSS 0.36%May 12, 2026