Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical10.0A path traversal vulnerability in the /content/images/add endpoint of shopizer v3.2.5 allows attackers write arbitrary files to any writeable path via a crafted POST request.Check if you run itEPSS 0.64%Apr 30, 2026
- Medium5.0A Server-Side Request Forgery (SSRF) in the /ureport/datasource/testConnection endpoint of SpringBlade v4.8.0 allows authenticated attackers to scan internal resources…Check if you run itEPSS 0.28%Apr 30, 2026
- Medium4.3A Server-Side Request Forgery (SSRF) in the /plugins/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a…Check if you run itEPSS 0.28%Apr 30, 2026
- High8.8A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0.Check if you run itEPSS 0.20%Apr 30, 2026
- Medium6.5A Server-Side Request Forgery (SSRF) in the /themes/{name}/upgrade-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a c…Check if you run itEPSS 0.35%Apr 30, 2026
- Medium4.3A Server-Side Request Forgery (SSRF) in the /themes/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a crafte…Check if you run itEPSS 0.28%Apr 30, 2026
- Medium5.4A Server-Side Request Forgery (SSRF) in the /plugins/-/install-from-uri endpoint of halo v2.22.14 allows authenticated attackers to scan internal resources via a craft…Check if you run itEPSS 0.24%Apr 30, 2026
- High7.5A denial-of-service vulnerability exists in the U-SPEED N300 V1.0.0 wireless router.Check if you run itEPSS 0.49%Apr 30, 2026
- High7.5Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Service via the boa web server URI handler.Check if you run itEPSS 0.49%Apr 30, 2026
- High8.8A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0.Check if you run itEPSS 0.21%Apr 30, 2026
- Medium5.5A vulnerability in the assisted-service REST API, an optional Assisted Installer (assisted-service) component in the Multicluster Engine (MCE), allows an authenticated…Check if you run itEPSS 0.20%Apr 30, 2026
- High7.7Unauthenticated attackers can exploit a weakness in the XML parser functionality of Lobster_pro prior to version 4.12.6-GA.Check if you run itEPSS 0.47%Apr 30, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: cifs: some missing initializations on replay In several places in the code, we have a label to sign…Check if you run itEPSS 0.18%Apr 30, 2026
- Medium5.3The Five Star Restaurant Reservations plugin for WordPress is vulnerable to a payment bypass via PHP type juggling in versions up to, and including, 2.7.16 This is due…Check if you run itEPSS 0.24%Apr 30, 2026
- High8.1As dhclient is building an environment to pass to dhclient-script, it may need to resize the array of string pointers.Check if you run itEPSS 1.81%Apr 30, 2026
- High8.7Unauthenticated attackers can exploit a weakness in the XML parser functionality of the SOAP endpoints in 4D server.Check if you run itEPSS 0.45%Apr 30, 2026
- Critical9.3Synway smg_gateway_management_software Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 5.73%Apr 30, 2026
- Unknownastro \@astrojs\/cloudflare Server-Side Request Forgery (SSRF)Patch nowKEVEPSS 0.87%Apr 30, 2026
- Unknownliquidfiles liquidfiles Authentication Bypass by Primary WeaknessPatch nowKEVEPSS 0.77%Apr 30, 2026
- Unknownvitest.dev vitest Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 2.40%Apr 30, 2026
- Critical9.3Weaver e-office Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.77%Apr 30, 2026
- Medium5.5A weakness has been identified in BurtTheCoder mcp-dnstwist up to 1.0.4.Check if you run itEPSS 2.11%Apr 29, 2026
- Medium5.5A vulnerability was found in Algovate xhs-mcp 0.8.11.Check if you run itEPSS 0.50%Apr 29, 2026
- Medium5.5A vulnerability was found in PolarVista xcode-mcp-server 1.0.0.Check if you run itEPSS 2.11%Apr 29, 2026
- Critical9.3Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient…Check if you run itEPSS 0.65%Apr 29, 2026