Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.3The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the InternetCheck if you run itEPSS 0.56%Jul 24, 2025
- Medium4.7A flaw was found in libssh, a library that implements the SSH protocol.Check if you run itEPSS 0.26%Jul 24, 2025
- High8.7A path traversal vulnerability exists in httpdasm version 0.92, a lightweight Windows HTTP server, that allows unauthenticated attackers to read arbitrary files on the host system.Check if you run itEPSS 2.08%Jul 23, 2025
- High8.5A local privilege escalation vulnerability exists in lastore-daemon, the system package manager daemon used in Deepin Linux (developed by Wuhan Deepin Technology Co., Ltd.).Check if you run itEPSS 0.48%Jul 23, 2025
- Critical9.3The Marathon UI in DC/OS < 1.9.0 allows unauthenticated users to deploy arbitrary Docker containers.Check if you run itEPSS 1.31%Jul 23, 2025
- Critical9.3oscommerce online_merchant Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 4.56%Jul 23, 2025
- Critical9.3Remote Control Server, maintained by Steppschuh, 3.1.1.12 allows unauthenticated remote code execution when authentication is disabled, which is the default configuration.Check if you run itEPSS 2.51%Jul 23, 2025
- Critical9.8An unauthenticated remote attacker may use a stack based buffer overflow in the u-link Management API to gain full access on the affected devices.Check if you run itEPSS 0.80%Jul 23, 2025
- High8.8An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web InterfaceCheck if you run itEPSS 0.84%Jul 23, 2025
- High8.8An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web InterfaceCheck if you run itEPSS 0.84%Jul 23, 2025
- Critical9.2The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability.Check if you run itEPSS 0.18%Jul 23, 2025
- High8.1A vulnerability has been found in Dahua products.Check if you run itEPSS 0.87%Jul 23, 2025
- High8.1A vulnerability has been found in Dahua products.Check if you run itEPSS 0.91%Jul 23, 2025
- Medium6.1Qwizcards Reflected Cross-Site Scripting (XSS)Patch nowKEVEPSS 0.50%Jul 23, 2025
- Medium6.5The Omnishop plugin for WordPress is vulnerable to Cross-Site Request Forgery on its /users/delete REST route in all versions up to, and including, 1.0.9.Check if you run itEPSS 0.18%Jul 23, 2025
- Critical9.3PCL (Plain Craft Launcher) Community Edition is a Minecraft launcher.Check if you run itEPSS 0.16%Jul 23, 2025
- UnknownUnrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.66%Jul 23, 2025
- UnknownImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 0.63%Jul 23, 2025
- Medium4.3HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend.Check if you run itEPSS 0.36%Jul 22, 2025
- Medium6.8Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets.Check if you run itEPSS 0.33%Jul 22, 2025
- Low3.6A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function.Check if you run itEPSS 0.23%Jul 22, 2025
- High8.7An authorization bypass vulnerability exists in ETQ Reliance (legacy CG and NXG SaaS platforms).Check if you run itEPSS 0.69%Jul 22, 2025
- Medium6.0The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver.Check if you run itEPSS 0.33%Jul 22, 2025
- High8.6WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in WebGUI.Check if you run itEPSS 1.02%Jul 22, 2025
- Critical9.8The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its order_info REST endpoint in versions 1.3.7 through 1.7.9.Check if you run itEPSS 0.79%Jul 22, 2025
Sort