Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.1A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a.Check if you run itEPSS 0.39%Jul 22, 2025
- High7.8Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition VulnerabilityPatch nowKEVEPSS 1.36%Jul 22, 2025
- Medium6.5Insecure Direct Object Reference (IDOR) vulnerability in Deepfiction AI (deepfiction.ai) thru June 3, 2025, allowing attackers to chat with the LLM using other users' credits via sCheck if you run itEPSS 0.37%Jul 22, 2025
- High8.8Ai2 playground web service (playground.allenai.org) LLM chat through 2025-06-03 is vulnerable to Insecure Direct Object Reference (IDOR), allowing attackers to gain sensitvie inforCheck if you run itEPSS 0.43%Jul 22, 2025
- Medium6.5A reflected cross-site scripting (XSS) vulnerability exists in AIBOX LLM chat (chat.aibox365.cn) through 2025-05-27, allowing attackers to hijack accounts through stolen JWT tokensCheck if you run itEPSS 0.41%Jul 22, 2025
- Medium6.1Insecure Direct Object Reference (IDOR) vulnerability in TelegAI (telegai.com) thru 2025-05-26 in its chat component.Check if you run itEPSS 0.27%Jul 22, 2025
- Medium6.1Stored Cross-Site Scripting (XSS) in TelegAI (telegai.com) 2025-05-26 in its chat component and character container component.Check if you run itEPSS 0.34%Jul 22, 2025
- Medium6.5Stored Cross-Site Scripting (XSS) vulnerability in Chaindesk thru 2025-05-26 in its agent chat component.Check if you run itEPSS 0.52%Jul 22, 2025
- Medium6.1Self Cross-Site Scripting (XSS) vulnerability in ChatPlayground.ai through 2025-05-24, allows attackers to execute arbitrary code and gain sensitive information via a crafted SVG fCheck if you run itEPSS 0.34%Jul 22, 2025
- High8.8letta letta Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 2.11%Jul 22, 2025
- High8.8Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted external_data.locatioCheck if you run itEPSS 0.68%Jul 22, 2025
- Medium6.5Code Injection in AgentTemplate.eval_agent_config in TransformerOptimus SuperAGI 0.0.14 allows remote attackers to execute arbitrary Python code via malicious values in agent templCheck if you run itEPSS 0.46%Jul 22, 2025
- High8.8Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitted to the /api/reportCheck if you run itEPSS 0.71%Jul 22, 2025
- High7.0Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file submitted to the run_Check if you run itEPSS 0.53%Jul 22, 2025
- Medium6.5File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a malicious plugin ZIP file uplCheck if you run itEPSS 0.40%Jul 22, 2025
- Medium6.5SQL Injection in editor_sql_run and query_ex in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary SQL statements via crafted input passed to the /v1/editor/sqlCheck if you run itEPSS 0.37%Jul 22, 2025
- High7.2HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend.Check if you run itEPSS 0.23%Jul 21, 2025
- Medium5.3Starlette is a lightweight ASGI (Asynchronous Server Gateway Interface) framework/toolkit, designed for building async web services in Python.Check if you run itEPSS 0.66%Jul 21, 2025
- Critical9.8Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Mail Login allows Brute Force.This issue affects Mail Login: from 3.0.0 before 3.2.0, from 4.0.0 bCheck if you run itEPSS 0.53%Jul 21, 2025
- High8.8A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to adjacent attackers achieving pre-auth code execution on High AvaiCheck if you run itEPSS 4.86%Jul 21, 2025
- Critical9.8An SQL injection vulnerability in the legacy (transparent) SMTP proxy of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to remote code execution, if a quarantiningCheck this weekEPSS 10.51%Jul 21, 2025
- Critical9.8An arbitrary file writing vulnerability in the Secure PDF eXchange (SPX) feature of Sophos Firewall versions older than 21.0 MR2 (21.0.2) can lead to pre-auth remote code executionCheck this weekEPSS 11.77%Jul 21, 2025
- High7.5An attacker spoofing answers to ECS enabled requests sent out by the Recursor has a chance of success higher than non-ECS enabled queries.Check if you run itEPSS 0.27%Jul 21, 2025
- Medium6.7A locally authenticated, privileged user can craft a malicious OpenSSL configuration file, potentially leading the agent to load an arbitrary local library.Check if you run itEPSS 0.20%Jul 21, 2025
- High8.7The EAI developed by Digiwin has a Privilege Escalation vulnerability, allowing remote attackers with regular privileges to elevate their privileges to administrator level via a spCheck if you run itEPSS 0.61%Jul 21, 2025
Sort