Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.1Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/plan endpoint.Open the advisoryDec 5, 2025
- High7.1Monkeytype is a minimalistic and customizable typing test.Open the advisoryDec 4, 2025
- Critical9.6DeepChat is a smart assistant uses artificial intelligence.Open the advisoryDec 3, 2025
- Medium5.4FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.Open the advisoryDec 1, 2025
- Medium6.9mdast-util-to-hast is an mdast utility to transform to hast.Open the advisoryDec 1, 2025
- Medium5.5A vulnerability was found in jsnjfz WebStack-Guns 1.0.Open the advisoryDec 1, 2025
- Unknownmaptiler tileserver_php Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 1.42%Nov 27, 2025
- Medium4.8@dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify…Open the advisoryNov 17, 2025
- High7.5An issue has been discovered in GitLab CE/EE affecting all versions from 7.12 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed unautho…Open the advisorySep 12, 2025
- Low1.3Versions of the package jsondiffpatch before 0.7.2 are vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin.Open the advisorySep 11, 2025
- Low1.9A vulnerability was detected in Scada-LTS up to 2.7.8.1.Open the advisorySep 11, 2025
- Medium5.3QuickCMS is vulnerable to Stored XSS via aDirFilesDescriptions parameter in files editor functionality.Open the advisoryAug 28, 2025
- Medium5.3QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality.Open the advisoryAug 28, 2025
- UnknownGrafana Labs Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 97.01%Jul 21, 2025
- Medium5.1A security flaw has been discovered in Portabilis i-Diario 1.5.0.Check this weekEPSS 31.00%Jul 20, 2025
- Medium6.9Fullscreen API Spoofing and UI Redressing in the handling of Fullscreen API and UI rendering in OpenAI Operator SaaS on Web allows a remote attacker to capture sensitive user inputCheck this weekEPSS 36.00%Jul 10, 2025
- Medium5.4The CheckUser extension’s Special:Investigate interface is vulnerable to reflected XSS due to improper escaping of certain internationalized system messages rendered on the “IPs anCheck this weekEPSS 20.00%Jul 7, 2025
- Medium5.4The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper escaping.Check this weekEPSS 20.00%Jul 7, 2025
- Critical9.1lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS).Check this weekEPSS 48.00%Jul 7, 2025
- High7.5Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution.Check if you run itEPSS 4.22%Jul 3, 2025
- Medium5.4In the PdfViewer component, a Cross-Site Scripting (XSS) vulnerability is possible if a specially-crafted document has already been loaded and the user engages with a tool that reqCheck this weekEPSS 27.00%Jul 2, 2025
- High8.0File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files.Check if you run itEPSS 1.21%Jun 26, 2025
- High7.2The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due to insufficient inputCheck this weekEPSS 31.00%Jun 26, 2025
- Medium5.1DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.Check this weekEPSS 21.00%Jun 21, 2025
- Medium6.1A flaw was found in the X Rendering extension's handling of animated cursors.Check this weekEPSS 34.00%Jun 17, 2025