Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8WeGIA is a web manager for charitable institutions.Check if you run itEPSS 0.44%Apr 17, 2026
- Medium5.4The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications.Check if you run itEPSS 0.26%Apr 17, 2026
- Low2.3mcp-neo4j-cypher is an MCP server for executing Cypher queries against Neo4j databases.Check if you run itEPSS 0.39%Apr 17, 2026
- High7.5Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes that can fa…Check if you run itEPSS 0.48%Apr 17, 2026
- High7.8OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private an…Check if you run itEPSS 0.29%Apr 17, 2026
- Low2.1A vulnerability was determined in prasathmani TinyFileManager up to 2.6.Check if you run itEPSS 0.35%Apr 17, 2026
- Medium5.5A weakness has been identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593.Check if you run itEPSS 0.41%Apr 17, 2026
- High7.0PAC4J is vulnerable to Cross-Site Request Forgery (CSRF).Check if you run itEPSS 0.18%Apr 17, 2026
- High7.5Craftql v1.3.7 and before is vulnerable to Server-Side Request Forgery (SSRF) which allows an attacker to execute arbitrary code via the vendor/markhuot/craftql/src/Li…Check if you run itEPSS 0.56%Apr 17, 2026
- Low2.1A vulnerability was identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593.Check if you run itEPSS 0.32%Apr 17, 2026
- Medium6.9GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access control lists for these pipes are configured incorrectly.Check if you run itEPSS 0.46%Apr 17, 2026
- Medium4.3The cms-fuer-motorrad-werkstaetten plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.0.0.Check if you run itEPSS 0.26%Apr 17, 2026
- Medium5.3The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and including 3.9.8.Check if you run itEPSS 0.41%Apr 17, 2026
- High8.6Vault’s PKI engine’s ACME validation did not reject local targets when issuing http-01 and tls-alpn-01 challenges.Check if you run itEPSS 0.39%Apr 17, 2026
- Medium6.1AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework.Check if you run itEPSS 0.32%Apr 16, 2026
- Medium6.9free5GC is an open-source implementation of the 5G core network.Check if you run itEPSS 0.39%Apr 16, 2026
- High8.7mcp-framework is a framework for building Model Context Protocol (MCP) servers.Check if you run itEPSS 0.57%Apr 16, 2026
- Critical9.1@fastify/middie versions 9.3.1 and earlier are vulnerable to middleware bypass when the deprecated Fastify ignoreDuplicateSlashes option is enabled.Check if you run itEPSS 0.49%Apr 16, 2026
- Critical9.1@fastify/middie versions 9.3.1 and earlier do not register inherited middleware directly on child plugin engine instances.Check if you run itEPSS 0.61%Apr 16, 2026
- High7.5The component accepts XML input through the publisher without disabling external entity resolution.Check if you run itEPSS 0.27%Apr 16, 2026
- High8.8The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to, and including, 1.6.Check if you run itEPSS 0.41%Apr 16, 2026
- High7.5The Payment Gateway for Redsys & WooCommerce Lite plugin for WordPress is vulnerable to Improper Verification of Cryptographic Signature in versions up to, and includi…Check if you run itEPSS 0.25%Apr 16, 2026
- Medium5.3The Riaxe Product Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.2.Check if you run itEPSS 0.57%Apr 16, 2026
- Medium4.3In Wago Smart Designer in versions up to 2.33.1 a low privileged remote attacker may enumerate projects and usernames through iterative requests to an specific endpoint.Check if you run itEPSS 0.32%Apr 16, 2026
- High8.1Luanti 5 before 5.15.2 sometimes allows unintended access to an insecure environment.Check if you run itEPSS 0.17%Apr 16, 2026