Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Object property name can consume while being parsed,…Check if you run itEPSS 0.91%Oct 16, 2026
- High7.5Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin.Check if you run itEPSS 0.43%Oct 16, 2026
- High7.5Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin.Check if you run itEPSS 0.43%Oct 16, 2026
- High7.5Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin.Check if you run itEPSS 0.43%Oct 16, 2026
- High7.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin.Check if you run itEPSS 0.43%Oct 16, 2026
- High7.7Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists.Check if you run itEPSS 0.31%Oct 16, 2026
- High8.8ZoneMinder is a free, open source closed-circuit television software application.Check if you run itEPSS 1.06%Oct 16, 2026
- High8.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin.Check if you run itEPSS 1.90%Oct 16, 2026
- Critical9.8Authentication bypass within in-house network in Apache Kylin.Check if you run itEPSS 0.66%Oct 16, 2026
- Critical9.8LMCache: Remote code execution via unsafe deserialization in multiprocess mode transportCheck if you run itEPSS 0.48%Oct 16, 2026
- Medium5.4weForms <= 1.6.28 - Unauthenticated Limited Media File Deletion via 'wpuf_files' ParameterCheck if you run itEPSS 0.28%Oct 16, 2026
- High7.2European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry HeaderCheck if you run itEPSS 0.27%Oct 16, 2026
- High7.2Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' ParameterCheck if you run itEPSS 0.28%Oct 16, 2026
- Medium6.4YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' ParameterCheck if you run itEPSS 0.21%Oct 16, 2026
- Critical9.8Improper Authentication vulnerability in Apache Kylin.Check if you run itEPSS 0.65%Oct 16, 2026
- Medium5.4IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to obtain sensitive information due to missing subtree checks during file handle resolution.Check if you run itEPSS 0.13%Oct 16, 2026
- High7.8IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege.Check if you run itEPSS 0.10%Oct 16, 2026
- High7.5Integer overflow in OpenModSim (<=1.11.0), leading to denial of serviceCheck if you run itEPSS 0.34%Oct 16, 2026
- Medium5.5GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c).Check if you run itEPSS 0.12%Oct 16, 2026
- High8.7LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins…Check if you run itEPSS 0.28%Oct 16, 2026
- High8.2Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payme…Check if you run itEPSS 0.26%Oct 16, 2026
- Low2.3tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie…Check if you run itEPSS 0.22%Oct 16, 2026
- Medium5.1tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard valida…Check if you run itEPSS 0.17%Oct 16, 2026
- Medium5.3WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets…Check if you run itEPSS 0.18%Oct 16, 2026
- Critical9.3LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-T…Check if you run itEPSS 0.51%Oct 16, 2026