Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows…Check if you run itEPSS 0.43%Oct 13, 2026
- Medium6.9FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by callin…Check if you run itEPSS 0.41%Oct 13, 2026
- High7.7Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and sk…Check if you run itEPSS 0.12%Oct 13, 2026
- Medium5.3Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by…Check if you run itEPSS 0.24%Oct 13, 2026
- Critical9.9An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generat…Check if you run itEPSS 0.79%Oct 13, 2026
- Critical9.3TanStack Router is a client-first, server-capable, fully type-safe router and full-stack framework for the web.Check if you run itEPSS 0.52%Oct 13, 2026
- High7.5Dio: Cross-origin redirect leaks sensitive request headers inCheck if you run itEPSS 0.36%Oct 13, 2026
- Medium6.5ESF-IDF is the Espressif Internet of Things (IOT) Development Framework.Check if you run itEPSS 0.26%Oct 13, 2026
- Medium6.9Axios is a promise-based HTTP client for the browser and Node.js.Check if you run itEPSS 0.53%Oct 13, 2026
- High8.8Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC MethodsCheck if you run itEPSS 0.33%Oct 13, 2026
- High8.6CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.Check if you run itEPSS 0.49%Oct 13, 2026
- Medium5.3The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value.Check if you run itEPSS 0.32%Oct 13, 2026
- Medium6.5The Okta RADIUS Agent does not validate the sub-attribute length when parsing a Vendor-Specific attribute.Check if you run itEPSS 0.21%Oct 13, 2026
- High7.1ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.Check if you run itEPSS 0.55%Oct 13, 2026
- High7.6ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.Check if you run itEPSS 0.59%Oct 13, 2026
- Medium6.9Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via un…Check if you run itEPSS 0.34%Oct 13, 2026
- Medium6.9Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent requests.Check if you run itEPSS 0.25%Oct 13, 2026
- High7.1Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass e…Check if you run itEPSS 0.26%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by subm…Check if you run itEPSS 0.28%Oct 13, 2026
- Medium5.3Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unpro…Check if you run itEPSS 0.26%Oct 13, 2026
- High8.6ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.Check if you run itEPSS 0.66%Oct 13, 2026
- High7.7ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.Check if you run itEPSS 0.73%Oct 13, 2026
- Medium5.3Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by…Check if you run itEPSS 0.20%Oct 13, 2026
- Low3.5Indico is a feature-rich event management system.Check if you run itEPSS 0.26%Oct 13, 2026
- Medium6.9FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows ma…Check if you run itEPSS 0.30%Oct 13, 2026