Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.3Weaver e-office Unrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.77%Apr 30, 2026
- Medium5.5A weakness has been identified in BurtTheCoder mcp-dnstwist up to 1.0.4.Check if you run itEPSS 2.11%Apr 29, 2026
- Medium5.5A vulnerability was found in Algovate xhs-mcp 0.8.11.Check if you run itEPSS 0.50%Apr 29, 2026
- Medium5.5A vulnerability was found in PolarVista xcode-mcp-server 1.0.0.Check if you run itEPSS 2.11%Apr 29, 2026
- Critical9.3Tenda FH303/A300 firmware V5.07.68_EN contains a session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient…Check if you run itEPSS 0.65%Apr 29, 2026
- Critical9.3Tenda W3002R/A302/W309R wireless routers version V5.07.64_en contain a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settin…Check if you run itEPSS 0.65%Apr 29, 2026
- Critical9.3Tenda W308R v2 V5.07.48 contains a cookie session weakness vulnerability that allows unauthenticated attackers to modify DNS settings by exploiting insufficient session validation.Check if you run itEPSS 0.65%Apr 29, 2026
- High7.1VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers with valid credentials to disclose arbitr…Check if you run itEPSS 0.60%Apr 29, 2026
- Medium5.3VideoFlow Digital Video Protection DVP 2.10 contains an authenticated remote code execution vulnerability that allows authenticated attackers to execute arbitrary syst…Check if you run itEPSS 0.21%Apr 29, 2026
- High8.8XATABoost CMS 1.0.0 contains a union-based SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code throu…Check if you run itEPSS 0.32%Apr 29, 2026
- Medium6.9Merge PACS 7.0 contains a cross-site request forgery vulnerability that allows attackers to perform unauthorized actions by crafting malicious HTML forms targeting the…Check if you run itEPSS 0.14%Apr 29, 2026
- High7.7AgentFlow contains an arbitrary code execution vulnerability that allows attackers to execute local Python pipeline files by supplying a user-controlled pipeline_path…Check if you run itEPSS 0.64%Apr 29, 2026
- Medium4.8AgentFlow's local web API accepts non-JSON content types on POST /api/runs and POST /api/runs/validate endpoints without enforcing application/json validation, allowin…Check if you run itEPSS 0.12%Apr 29, 2026
- Medium6.5Wazuh is a free and open source platform used for threat prevention, detection, and response.Check if you run itEPSS 0.28%Apr 29, 2026
- High8.8This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a…Check if you run itEPSS 0.29%Apr 29, 2026
- High7.8An issue in the TVicPort64.sys component of EnTech Taiwan TVicPort Product v4.0, File v5.2.1.0 allows attackers to escalate privileges via sending crafted IOCTL 0x8000…Check if you run itEPSS 0.15%Apr 29, 2026
- Medium4.3Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V.Check if you run itEPSS 0.14%Apr 29, 2026
- Medium5.4Server-Side Request Forgery (SSRF) vulnerability in ILLID Share This Image share-this-image allows Server Side Request Forgery.This issue affects Share This Image: fro…Check if you run itEPSS 0.22%Apr 29, 2026
- Medium5.3Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.Check if you run itEPSS 0.34%Apr 29, 2026
- Low3.1Spring MVC and WebFlux applications are vulnerable to cache poisoning when resolving static resources.Check if you run itEPSS 0.24%Apr 29, 2026
- Medium6.5A WebFlux server application that processes multipart requests creates temp files for parts larger than 10 K.Check if you run itEPSS 0.34%Apr 29, 2026
- High7.1This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data.Check if you run itEPSS 0.35%Apr 29, 2026
- High7.1This vulnerability exists in e-Sushrut due to improper authorization checks during resource access.Check if you run itEPSS 0.35%Apr 29, 2026
- High7.1This vulnerability exists in e-Sushrut due to improper access control in resource access validation.Check if you run itEPSS 0.35%Apr 29, 2026
- Critical10.0SQL injection (SQLi) in MegaCMS v12.0.0, specifically in the “id_territorio” parameter of the “/web_comunications/cms/get_provincias” endpoint.Check if you run itEPSS 0.45%Apr 29, 2026