Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownImproper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 38.04%Aug 2, 2025
- High7.3Traefik is an HTTP reverse proxy and load balancer.Check if you run itEPSS 1.27%Aug 1, 2025
- Medium5.1Files is a module for managing files inside spaces and user profiles.Check if you run itEPSS 0.30%Aug 1, 2025
- High7.2Cursor is a code editor built for programming with AI.Check this weekEPSS 28.52%Aug 1, 2025
- Medium5.3Cursor is a code editor built for programming with AI.Check if you run itEPSS 0.41%Aug 1, 2025
- Medium4.4Cursor is a code editor built for programming with AI.Check if you run itEPSS 0.38%Aug 1, 2025
- Medium6.4Cursor is a code editor built for programming with AI.Check if you run itEPSS 0.51%Aug 1, 2025
- High8.11Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server.Check if you run itEPSS 1.01%Aug 1, 2025
- Critical9.3An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint expCheck if you run itEPSS 2.78%Aug 1, 2025
- High8.6An authenticated OS command injection vulnerability exists in various Linksys router models (tested on WRT160Nv2) running firmware version v2.0.03 via the apply.cgi endpoint.Check if you run itEPSS 4.32%Aug 1, 2025
- High8.5Kloxo versions 6.1.12 and earlier contain two setuid root binaries—lxsuexec and lxrestart—that allow local privilege escalation from uid 48.Check if you run itEPSS 0.46%Aug 1, 2025
- Critical9.3An unauthenticated arbitrary file upload vulnerability exists in Havalite CMS version 1.1.7 (and possibly earlier) in the upload.php script.Check if you run itEPSS 1.68%Aug 1, 2025
- Critical9.3An OS command injection vulnerability exists in various legacy D-Link routers—including DIR-300 rev B and DIR-600 (firmware ≤ 2.13 and ≤ 2.14b01, respectively)—due to improper inpuCheck this weekEPSS 16.87%Aug 1, 2025
- High8.6An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint.Check this weekEPSS 26.30%Aug 1, 2025
- High7.3Pearcleaner is a free, source-available and fair-code licensed mac app cleaner.Check if you run itEPSS 0.19%Aug 1, 2025
- High7.2FreshRSS is a free, self-hostable RSS aggregator.Check if you run itEPSS 0.88%Aug 1, 2025
- Medium5.5MaterialX is an open standard for the exchange of rich material and look-development content across applications and renderers.Check if you run itEPSS 0.89%Aug 1, 2025
- High7.4IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack.Check if you run itEPSS 0.35%Aug 1, 2025
- Critical9.1A privileged Vault operator within the root namespace with write permission to {{sys/audit}} may obtain code execution on the underlying host if a plugin directory is set in Vault’Check if you run itEPSS 0.95%Aug 1, 2025
- Medium5.8The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which couldCheck if you run itEPSS 0.19%Aug 1, 2025
- Critical9.8It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian PackaCheck if you run itEPSS 0.26%Aug 1, 2025
- Medium6.5The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_dCheck if you run itEPSS 0.34%Aug 1, 2025
- High7.2The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vuCheck if you run itEPSS 0.25%Aug 1, 2025
- Critical9.8Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint.Check if you run itEPSS 0.38%Aug 1, 2025
- Medium6.1A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input fields for Query and Answer do not propeCheck if you run itEPSS 0.20%Aug 1, 2025
Sort