Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.9Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations.Check if you run itEPSS 0.35%Oct 12, 2026
- Medium5.3QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController,…Open the advisoryOct 12, 2026
- Low3.1A flaw was found in Quay.Check if you run itEPSS 0.15%Oct 12, 2026
- Medium6.4A flaw was found in Red Hat Quay.Check if you run itEPSS 0.17%Oct 12, 2026
- High8.8Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user with the “Messages” permissi…Check if you run itEPSS 0.39%Oct 12, 2026
- High8.8ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1Check if you run itEPSS 0.36%Oct 12, 2026
- Medium5.3Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution TokensCheck if you run itEPSS 0.17%Oct 12, 2026
- Critical9.2LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization HeaderCheck if you run itEPSS 0.46%Oct 12, 2026
- Medium5.3LibreNMS before 26.9.0 Stored XSS via wireless sensor descriptionCheck if you run itEPSS 0.20%Oct 12, 2026
- High8.6Adminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH BypassCheck if you run itEPSS 0.65%Oct 12, 2026
- Medium5.3SurrealDB 3.0.0 before 3.3.0 Missing Authentication in revoke RPC MethodCheck if you run itEPSS 0.28%Oct 12, 2026
- Medium5.3SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT WHERE ClauseCheck if you run itEPSS 0.24%Oct 12, 2026
- Low2.3Network-AI before 5.15.2 CORS Origin Validation Error in MCP SSE TransportCheck if you run itEPSS 0.12%Oct 12, 2026
- Medium5.1Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.phpCheck if you run itEPSS 0.21%Oct 12, 2026
- Medium5.3Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin ViewsCheck if you run itEPSS 0.20%Oct 12, 2026
- Critical9.3Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic .Check if you run itEPSS 0.40%Oct 12, 2026
- High8.6Grav API Plugin before 1.0.36 Privilege Escalation via Scalar Access GrantsCheck if you run itEPSS 0.36%Oct 12, 2026
- High8.6Grav Login Plugin 2.7.0 before 3.9.9 2FA Bypass via Profile Update FormCheck if you run itEPSS 0.35%Oct 12, 2026
- Low2.1Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA VerificationCheck if you run itEPSS 0.18%Oct 12, 2026
- Medium6.3Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted QueriesCheck if you run itEPSS 0.22%Oct 12, 2026
- High7.1Open WebUI 0.11.0 before 0.11.4 Denial of Service via Automation Recurrence RulesCheck if you run itEPSS 0.31%Oct 12, 2026
- High7.6Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode ConnectionsCheck if you run itEPSS 0.32%Oct 12, 2026
- Medium5.3Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory IDCheck if you run itEPSS 0.22%Oct 12, 2026
- Low2.0ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 Undefined Behavior in INFO, JSON and YAML EncodersCheck if you run itEPSS 0.11%Oct 12, 2026
- High8.5Server-side request forgery in Progress MarkLogic Server Linux cloud deploymentsCheck if you run itEPSS 0.19%Oct 12, 2026