Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low3.5In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tabCheck this weekEPSS 63.03%Apr 25, 2025
- Medium4.9In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possibleCheck if you run itEPSS 0.55%Apr 25, 2025
- Medium4.3In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logsCheck if you run itEPSS 1.01%Apr 25, 2025
- Medium5.4In JetBrains Rider before 2025.1.2 custom archive unpacker allowed arbitrary file overwrite during remote debug sessionCheck if you run itEPSS 0.37%Apr 25, 2025
- High8.1ConnectWise ScreenConnect Improper Authentication VulnerabilityPatch nowKEVEPSS 3.54%Apr 25, 2025
- High7.5The Mayosis Core plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.4.1 via the library/wave-audio/peaks/remote_dl.php file.Check if you run itEPSS 0.55%Apr 25, 2025
- High8.8The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the ux_cb_Check if you run itEPSS 0.38%Apr 25, 2025
- High7.5React Router is a router for React.Check this weekEPSS 20.47%Apr 25, 2025
- High7.5OpenPLC 3 through 64f9c11 has server.cpp Memory Corruption because a thread may access handleConnections arguments after the parent stack frame becomes unavailable.Check if you run itEPSS 0.24%Apr 25, 2025
- Medium5.4In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effects of an attacker conducting XSS attacks, adding a new user or role, oCheck if you run itEPSS 0.17%Apr 25, 2025
- Critical9.8NETSCOUT nGeniusONE before 6.4.0 b2350 has Hardcoded Credentials that can be obtained from JAR files.Check if you run itEPSS 0.44%Apr 25, 2025
- Medium6.1NETSCOUT nGeniusONE before 6.4.0 b2350 allows Stored Cross-Site Scripting (XSS) via a certain POST parameter.Check if you run itEPSS 0.25%Apr 25, 2025
- Low2.4Andamiro Pump It Up 20th Anniversary (aka Double X or XX/2019) 1.00.0-2.08.3 allows a physically proximate attacker to cause a denial of service (application crash) via certain desCheck if you run itEPSS 0.21%Apr 25, 2025
- High8.7Vestel AC Charger version 3.75.0 contains a vulnerability that could enable an attacker to access files containing sensitive information, such as credentials which could be used toCheck if you run itEPSS 0.41%Apr 24, 2025
- Critical9.3UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices.Check if you run itEPSS 0.56%Apr 24, 2025
- Critical9.3Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issueCheck if you run itEPSS 0.58%Apr 24, 2025
- Critical9.1h11 is a Python implementation of HTTP/1.1.Check if you run itEPSS 0.59%Apr 24, 2025
- Medium4.1Improper access control of endpoint in HCL Leap allows certain admin users to import applications from the server's filesystem.Check if you run itEPSS 0.28%Apr 24, 2025
- Medium5.3Missing Authorization vulnerability in vinodvaswani9 Bulk Assign Linked Products For WooCommerce wc-bulk-assign-linked-products allows Accessing Functionality Not Properly ConstraiCheck if you run itEPSS 0.34%Apr 24, 2025
- Medium5.3Missing Authorization vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affeCheck if you run itEPSS 0.34%Apr 24, 2025
- Medium5.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdrift.no Landing pages and Domain aliases for WordPress landing-pages-and-doCheck if you run itEPSS 0.23%Apr 24, 2025
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Codebangers All in One Time Clock Lite aio-time-clock-lite allows Cross Site Request Forgery.This issue affects All in One Time CCheck if you run itEPSS 0.15%Apr 24, 2025
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in Steve Availability Calendar availability allows Stored XSS.This issue affects Availability Calendar: from n/a through <= 0.2.4.Check if you run itEPSS 0.14%Apr 24, 2025
- High7.1Cross-Site Request Forgery (CSRF) vulnerability in Olar Marius Vasaio QR Code vasaio-qr-code allows Stored XSS.This issue affects Vasaio QR Code: from n/a through <= 1.2.5.Check if you run itEPSS 0.15%Apr 24, 2025
- Medium5.3Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Accessing Functionality Not Properly ConstrainedCheck if you run itEPSS 0.34%Apr 24, 2025
Sort