Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.2The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Database module in versions 3.5.11 to 3.5.19 due to insufficient inputCheck this weekEPSS 31.00%Jun 26, 2025
- Medium5.1DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.Check this weekEPSS 21.00%Jun 21, 2025
- Medium6.1A flaw was found in the X Rendering extension's handling of animated cursors.Check this weekEPSS 34.00%Jun 17, 2025
- Medium4.5A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with privileges to create/updaCheck if you run itEPSS 0.25%Jun 12, 2025
- Medium6.7A SQL injection vulnerability in RSMediaGallery! component 1.7.4 - 2.1.7 for Joomla was discovered.Check if you run itEPSS 0.31%Jun 11, 2025
- Medium6.0Nautobot is a Network Source of Truth and Network Automation Platform.Check if you run itEPSS 0.37%Jun 10, 2025
- High7.5GeoServer is an open source server that allows users to share and edit geospatial data.Check if you run itEPSS 0.51%Jun 10, 2025
- High8.5SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to drop arbitrary SAP database tables, potentially resulting in a loss of data or rendering the systemCheck if you run itEPSS 0.31%Jun 10, 2025
- Medium6.5HAX CMS PHP allows users to manage their microsite universe with a PHP backend.Check if you run itEPSS 0.52%Jun 9, 2025
- High8.5HAX CMS PHP allows users to manage their microsite universe with a PHP backend.Check if you run itEPSS 0.27%Jun 9, 2025
- Unknownvercel next.js Authorization Bypass Through User-Controlled KeyPatch nowKEVEPSS 59.18%Jun 8, 2025
- Medium4.3In Splunk Enterprise versions below 9.4.2, 9.3.4 and 9.2.6, and Splunk Cloud Platform versions below 9.3.2411.102, 9.3.2408.111 and 9.2.2406.118, a low-privileged user that does noCheck this weekEPSS 29.30%Jun 2, 2025
- High7.5Qualcomm Multiple Chipsets Use-After-Free VulnerabilityPatch nowKEVEPSS 1.02%Jun 2, 2025
- High8.1The desktop application in Dot through 0.9.3 allows XSS and resultant command execution because user input and LLM output are appended to the DOM with innerHTML (in render.js), andCheck if you run itEPSS 0.22%Jun 2, 2025
- High7.5MikroTik RouterOS 6.40.5, the SMB service contains a memory corruption vulnerability.Check this weekEPSS 55.00%May 29, 2025
- Medium6.1DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.Check this weekEPSS 28.00%May 23, 2025
- Critical9.8An Out of Bounds Write occurs when the native library attempts PDF rendering, which can be exploited to achieve memory corruption and potentially arbitrary code execution.Check this weekEPSS 69.00%May 23, 2025
- Medium5.3Group-Office is an enterprise customer relationship management and groupware tool.Check this weekEPSS 26.00%May 22, 2025
- Medium6.5The ChatGPT system through 2025-03-30 performs inline rendering of SVG documents (instead of, for example, rendering them as text inside a code block), which enables HTML injectionCheck this weekEPSS 67.00%May 19, 2025
- Low2.0Cross-site scripting (XSS) in Icewarp Mail Server affecting version 11.4.0.Check this weekEPSS 22.00%May 16, 2025
- High8.1Thunderbird's handling of the X-Mozilla-External-Attachment-URL header can be exploited to execute JavaScript in the file:/// context.Check if you run itEPSS 0.47%May 14, 2025
- High8.8Jan v0.5.14 and before is vulnerable to remote code execution (RCE) when the user clicks on a rendered link in the conversation, due to opening external website in the app and theCheck this weekEPSS 62.00%May 9, 2025
- High7.8Out-of-Bounds Read in Virglrenderer in ChromeOS 16093.57.0 allows a malicious guest VM to achieve arbitrary address access within the crosvm sandboxed process, potentially leadingCheck if you run itEPSS 0.11%May 6, 2025
- Critical9.0Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-reactCheck if you run itEPSS 0.98%May 5, 2025
- Critical9.1Due to the improper configuration of XML parser, user-supplied XML is parsed without applying sufficient restrictions, enabling XML External Entity (XXE) resolution in multiple WSOCheck if you run itEPSS 1.29%May 5, 2025