Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.8A vulnerability in the change password functionality of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote attacker to bypass authenti…Check if you run itEPSS 0.99%Apr 1, 2026
- Medium6.1A vulnerability in Cisco Nexus Dashboard and Cisco Nexus Dashboard Insights could allow an unauthenticated, remote attacker to conduct a server-side request forgery (S…Check if you run itEPSS 0.24%Apr 1, 2026
- Critical9.8A command injection vulnerability in the component /jmreport/show of jeecg boot v3.0.0 to v3.5.3 allows attackers to execute arbitrary code via a crafted HTTP request.Check if you run itEPSS 1.53%Apr 1, 2026
- Critical9.8There is an injection vulnerability in jeecg boot versions 3.0.0 to 3.5.3 due to lax character filtering, which allows attackers to execute arbitrary code on component…Check if you run itEPSS 0.52%Apr 1, 2026
- Medium5.0Improper access control in the multi-factor authentication (MFA) management API in Devolutions Server allows an authenticated attacker to delete their own configured M…Check if you run itEPSS 0.36%Apr 1, 2026
- Medium4.3Improper input validation in the gateway health check feature in Devolutions Server allows a low-privileged authenticated user to perform server-side request forgery (…Check if you run itEPSS 0.27%Apr 1, 2026
- Medium6.5Exposure of sensitive information in the users MFA feature in Devolutions Server allows users with user management privileges to obtain other users OTP keys via an aut…Check if you run itEPSS 0.38%Apr 1, 2026
- Medium5.0Improper access control in the users MFA feature in Devolutions Server allows an authenticated user to bypass administrator-enforced restrictions and remove their own…Check if you run itEPSS 0.33%Apr 1, 2026
- High8.2Improper authentication in the OAuth login functionality in Devolutions Server 2026.1.11 and earlier allows a remote attacker with valid credentials to bypass multi-fa…Check if you run itEPSS 0.41%Apr 1, 2026
- Medium6.9OpenViking versions 0.2.5 prior to 0.2.14 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthenticated attackers to access…Check if you run itEPSS 0.78%Apr 1, 2026
- Medium6.5A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation.Check if you run itEPSS 0.39%Apr 1, 2026
- Critical9.3metinfo metinfo Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 4.50%Apr 1, 2026
- Medium6.9Blind server-side request forgery (SSRF) vulnerability in legacy connection methods of document co-authoring features in M-Files Server before 26.3 allow an unauthenti…Check if you run itEPSS 0.19%Apr 1, 2026
- Low2.1A vulnerability was determined in AutohomeCorp frostmourne up to 1.0.Check if you run itEPSS 0.35%Apr 1, 2026
- Critical9.1The Order Notification for WooCommerce WordPress plugin before 3.6.3 overrides WooCommerce's permission checks to grant full access to all unauthenticated requests, en…Check if you run itEPSS 0.24%Apr 1, 2026
- High7.1Addressed a potential insecure direct object reference (IDOR) vulnerability in the signing invitation acceptance process.Check if you run itEPSS 0.29%Apr 1, 2026
- High8.7XenForo before 2.3.5 allows OAuth2 client applications to request unauthorized scopes.Check if you run itEPSS 0.27%Apr 1, 2026
- Medium6.5The Booking for Appointments and Events Calendar - Amelia plugin for WordPress is vulnerable to SQL Injection via the parameter in the payments listing endpoint in all…Check if you run itEPSS 0.41%Apr 1, 2026
- UnknownInsertion of Sensitive Information into Log FilePatch nowKEVEPSS 1.92%Apr 1, 2026
- UnknownZoho ManageEngine ADSelfService Plus Username EnumerationPatch nowKEVEPSS 10.03%Apr 1, 2026
- Medium6.1FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.Check if you run itEPSS 0.32%Mar 31, 2026
- Medium6.5cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library.Check if you run itEPSS 0.28%Mar 31, 2026
- Critical9.4APTRS (Automated Penetration Testing Reporting System) is a Python and Django-based automated reporting tool designed for penetration testers and security organizations.Check if you run itEPSS 0.80%Mar 31, 2026
- Medium6.5XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents.Check if you run itEPSS 1.39%Mar 31, 2026
- Medium6.5WWBN AVideo is an open source video platform.Check if you run itEPSS 0.35%Mar 31, 2026