Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Unknownwas registered without the sign-in middleware that provides the cross-origin protection, so a request issued by a third-party site was not rejected.Open the advisoryOct 18, 2026
- Low1.9A flaw has been found in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e.Open the advisoryOct 18, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6_find_hdr() return an offset past the packet end ipv6_find_hdr() walks the ext…Open the advisoryOct 18, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure ena_device_init() initializes the MMIO read me…Open the advisoryOct 18, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() nfc_llcp_recv_hdlc() reads the sequ…Open the advisoryOct 18, 2026
- Medium5.5A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1.Open the advisoryOct 18, 2026
- High7.1JeecgBoot before 3.9.5 contains an sql injection vulnerability that allows authenticated attackers to bypass the SqlInjectionUtil keyword blocklist by inserting newlin…Open the advisoryOct 18, 2026
- Critical9.3Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token.Check if you run itEPSS 0.00%Oct 18, 2026
- High7.1The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on…Open the advisoryOct 18, 2026
- Medium4.3The Salon Booking System WordPress plugin before 10.31.11 does not restrict one of its REST API endpoints to salon staff, allowing any authenticated user, such as a su…Open the advisoryOct 18, 2026
- Medium5.5The Salon Booking System WordPress plugin before 10.31.11 does not restrict which user account its salon staff roles may edit through the customers management screen,…Open the advisoryOct 18, 2026
- High7.2The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other acc…Open the advisoryOct 18, 2026
- Medium5.5A security flaw has been discovered in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.Open the advisoryOct 18, 2026
- Unknownplex media_server External Control of File Name or PathPatch nowKEVOct 18, 2026
- Medium6.9Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblinks because rss/links.php omi…Open the advisoryOct 17, 2026
- High7.1Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in modules/inventory/inventory_data.php that allows authenticated users to bypass the…Open the advisoryOct 17, 2026
- Medium5.3Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to export lists despite export restrictions by requesting mode=pdfl.Open the advisoryOct 17, 2026
- High7.1Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify ot…Open the advisoryOct 17, 2026
- High7.2phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users with delete_user permission…Open the advisoryOct 17, 2026
- High7.1phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database endpoint, which executes database migrations wit…Open the advisoryOct 17, 2026
- High7.1phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSearch administration API endp…Open the advisoryOct 17, 2026
- High7.0phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/user/data/{userId}, which re…Open the advisoryOct 17, 2026
- Medium5.1phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that allows users with FAQ_EDIT permission to bypass saniti…Open the advisoryOct 17, 2026
- High7.7phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_use…Open the advisoryOct 17, 2026
- High7.6phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable prefer…Open the advisoryOct 17, 2026
4,281 records · page 1 of 172
PreviousNext