Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3The ShopEngine Elementor WooCommerce Builder Addon plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.8.5.Check if you run itEPSS 0.12%Dec 3, 2025
- High7.6MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients.Open the advisoryDec 2, 2025
- Medium5.4The BigFix SaaS's HTTP responses were missing some security headers.Open the advisoryDec 2, 2025
- Medium6.3In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their length exc…Check if you run itEPSS 0.23%Dec 2, 2025
- Medium4.3The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8.Check if you run itEPSS 0.16%Dec 2, 2025
- Medium4.3The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20.Check if you run itEPSS 0.15%Dec 2, 2025
- Medium6.5The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.19.Check if you run itEPSS 0.16%Dec 2, 2025
- Medium6.9Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails.Open the advisoryDec 1, 2025
- Critical9.8fontTools is a library for manipulating fonts, written in Python.Open the advisoryNov 29, 2025
- Medium6.0An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.11, FortiOS 7.2 all versions,…Open the advisoryNov 18, 2025
- High7.2Fortinet FortiWeb OS Command Injection VulnerabilityPatch nowKEVEPSS 55.58%Nov 18, 2025
- High7.5SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.Open the advisoryNov 13, 2025
- High7.8Improper verification of cryptographic signature in the installer for Zoom Workplace VDI Client for Windows may allow an authenticated user to conduct an escalation of…Open the advisoryNov 13, 2025
- High7.5External control of file name or path in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via network access.Open the advisoryNov 13, 2025
- High7.8In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_objref: validate objref and objrefmap expressions Referencing a synproxy stateful ob…Check if you run itEPSS 0.15%Nov 12, 2025
- Medium6.5Evervault is a payment security solution.Open the advisoryNov 12, 2025
- High7.7An arbitrary file upload vulnerability was reported in the Lenovo Scanner Pro client during an internal security assessment that could allow remote code execution or u…Check if you run itEPSS 0.25%Nov 12, 2025
- High7.7A potential vulnerability was reported in the Lenovo PC Manager, Lenovo App Store, Lenovo Browser, and Lenovo Legion Zone client applications that, under certain condi…Check if you run itEPSS 0.22%Nov 12, 2025
- High8.1Open Access Management (OpenAM) is an access management solution.Open the advisoryNov 12, 2025
- Medium5.1The a+HRD and a+HCM developed by aEnrich has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to upload files containing malicious…Check if you run itEPSS 0.21%Nov 12, 2025
- Medium4.3The Asgaros Forum plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1.Check if you run itEPSS 0.17%Nov 12, 2025
- Medium5.2A health check port on Zscaler Client Connector on Windows, versions 4.6 < 4.6.0.216 and 4.7 < 4.7.0.47, which under specific circumstances was not released after use,…Open the advisoryNov 12, 2025
- High8.7A vulnerability has been identified in Solid Edge SE2025 (All versions < V225.0 Update 11).Open the advisoryNov 11, 2025
- UnknownImproper Neutralization of Special Elements used in a Command ('Command Injection')Patch nowKEVEPSS 1.54%Nov 7, 2025
- Critical9.8React Native Community CLI OS Command Injection VulnerabilityPatch nowKEVEPSS 93.98%Nov 3, 2025