Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1Cross Site Scripting vulnerability in andrewtch88 mvc-ecommerce v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information via the produ…Check if you run itEPSS 0.21%Apr 30, 2026
- High8.8A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0.Check if you run itEPSS 0.17%Apr 30, 2026
- Medium6.5A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a c…Check if you run itEPSS 0.21%Apr 30, 2026
- Medium4.3A Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafte…Check if you run itEPSS 0.17%Apr 30, 2026
- Medium5.4A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a craft…Check if you run itEPSS 0.14%Apr 30, 2026
- High8.1An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email functionCheck if you run itEPSS 0.57%Apr 30, 2026
- High8.8Improper Restriction of XML External Entity Reference vulnerability in RTI Connext Professional (Core Libraries) allows Serialized Data External Linking.Check if you run itEPSS 0.21%Apr 30, 2026
- Medium5.4When Keycloak is started with , the Account REST API is only partially disabled.Check if you run itEPSS 0.23%Apr 30, 2026
- High7.5U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint.Check if you run itEPSS 0.35%Apr 30, 2026
- High7.5A denial-of-service vulnerability exists in the U-SPEED N300 V1.0.0 wireless router.Check if you run itEPSS 0.32%Apr 30, 2026
- High7.5Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Service via the boa web server URI handler.Check if you run itEPSS 0.32%Apr 30, 2026
- High8.8A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0.Check if you run itEPSS 0.16%Apr 30, 2026
- High7.2This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project.Check if you run itEPSS 0.90%Apr 30, 2026
- Medium5.5A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated…Check if you run itEPSS 0.19%Apr 30, 2026
- High7.5The Otter Blocks plugin for WordPress is vulnerable to Purchase Verification Bypass in all versions up to, and including, 3.1.4.Check if you run itEPSS 0.32%Apr 30, 2026
- High8.1Improper Control of Interaction Frequency vulnerability in MeWare Software Development Inc.Check if you run itEPSS 0.38%Apr 30, 2026
- High8.1Authorization bypass through User-Controlled key vulnerability in MeWare Software Development Inc.Check if you run itEPSS 0.33%Apr 30, 2026
- Medium6.5Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability in MeWare Software Development Inc.Check if you run itEPSS 0.34%Apr 30, 2026
- High7.4Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick.Check if you run itEPSS 0.22%Apr 30, 2026
- High7.7Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA.Check if you run itEPSS 0.47%Apr 30, 2026
- Medium5.9Dancer::Session::Abstract versions through 1.3522 for Perl generates session ids insecurely.Check if you run itEPSS 0.36%Apr 30, 2026
- High7.5In JetBrains IntelliJ IDEA before 2024.3.7.1, 2025.1.7.1, 2025.2.6.2, 2025.3.4.1, 2026.1.1 reading arbitrary local files was possible via built-in web serverCheck if you run itEPSS 0.40%Apr 30, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: cifs: some missing initializations on replay In several places in the code, we have a label to sign…Check if you run itEPSS 0.17%Apr 30, 2026
- Medium4.6LEX Baza Dokumentów is vulnerable to DOM-based XSS in "em" cookie parameter.Check if you run itEPSS 0.18%Apr 30, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmd_vm_ops defines .close (privcmd_close), but n…Check if you run itEPSS 0.18%Apr 30, 2026
Sort