Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.0@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers vi…Check if you run itEPSS 0.56%Apr 15, 2026
- Critical9.1@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins.Check if you run itEPSS 0.53%Apr 15, 2026
- Medium6.1The OPEN-BRAIN plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.0.Check if you run itEPSS 0.21%Apr 15, 2026
- Medium4.3The Petje.af plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.1.8.Check if you run itEPSS 0.20%Apr 15, 2026
- Medium5.3The MetForm Pro plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 3.9.7 This is due to the payment integrations (St…Check if you run itEPSS 0.27%Apr 15, 2026
- Medium4.3The Inquiry Form to Posts or Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Stored Cross-Site Scripting in version 1.0.Check if you run itEPSS 0.23%Apr 15, 2026
- Unknownfacebook react Deserialization of Untrusted DataPatch nowKEVEPSS 66.88%Apr 15, 2026
- High7.2An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may…Check if you run itEPSS 0.88%Apr 14, 2026
- High8.6Jellyfin is an open source self hosted media server.Check if you run itEPSS 0.38%Apr 14, 2026
- Critical9.1OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers.Check if you run itEPSS 0.66%Apr 14, 2026
- High7.0Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated WCF SOAP endpoint on TCP port 1208 that accepts unsanitized file pat…Check if you run itEPSS 0.99%Apr 14, 2026
- High7.1Chamilo LMS is an open-source learning management system.Check if you run itEPSS 0.36%Apr 14, 2026
- Medium6.5Chamilo LMS is an open-source learning management system.Check if you run itEPSS 0.39%Apr 14, 2026
- High8.6Chamilo LMS is an open-source learning management system.Check if you run itEPSS 0.57%Apr 14, 2026
- High7.2Chamilo LMS is an open-source learning management system.Check if you run itEPSS 0.35%Apr 14, 2026
- High7.7Kyverno APICall SSRF Vulnerability Leading to Multi-Tenant Isolation Breach in github.com/kyverno/kyvernoCheck if you run itEPSS 0.36%Apr 14, 2026
- High8.8A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiDDoS-F 7.2.1 through 7.2.2 may allow attacker to…Check if you run itEPSS 0.51%Apr 14, 2026
- Critical9.8Fortinet FortiSandbox Path Traversal: '../filedir'Patch nowKEVEPSS 0.72%Apr 14, 2026
- Medium6.7A improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.0 through 7.4.5, FortiClientEMS 7.2…Check if you run itEPSS 0.20%Apr 14, 2026
- Medium6.5An improper authorization vulnerability in the /api/v1/users/{id} endpoint of Snipe-IT v8.4.0 allows authenticated attackers with the users.edit permission to modify s…Check if you run itEPSS 0.50%Apr 14, 2026
- High8.1A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrar…Check if you run itEPSS 0.41%Apr 14, 2026
- High8.1A Broken Object-Level Authorization (BOLA) in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrari…Check if you run itEPSS 0.41%Apr 14, 2026
- High8.8A Broken Object-Level Authorization (BOLA) in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset…Check if you run itEPSS 0.84%Apr 14, 2026
- High8.5A Server-Side Request Forgery (SSRF) in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via supplying a…Check if you run itEPSS 0.33%Apr 14, 2026
- Medium5.3CWE-400 Uncontrolled Resource Consumption vulnerability exists that could cause excessive troubleshooting zip file creation and denial of service when a Web Admin user…Check if you run itEPSS 0.24%Apr 14, 2026