Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8Microsoft Windows SMB Client Improper Access Control VulnerabilityPatch nowKEVEPSS 82.70%Jun 10, 2025
- High8.8Microsoft Windows External Control of File Name or Path VulnerabilityPatch nowKEVEPSS 87.02%Jun 10, 2025
- UnknownMicrosoft Windows Use After FreePatch nowKEVEPSS 16.26%Jun 10, 2025
- Medium5.4Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune.Check if you run itEPSS 0.34%Jun 5, 2025
- Critical9.8Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network.Check if you run itEPSS 1.16%Jun 5, 2025
- Critical9.9A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthCheck if you run itEPSS 1.11%Jun 4, 2025
- Medium5.5Umbraco is an ASP.NET content management system (CMS).Check if you run itEPSS 0.18%Jun 3, 2025
- High8.0In Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, a new installation of or an upgrade to an affected version can result in incorrect permissions assCheck if you run itEPSS 0.29%Jun 2, 2025
- High7.5ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.Check if you run itEPSS 0.83%Jun 2, 2025
- Medium6.5IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as tCheck this weekEPSS 41.00%May 29, 2025
- Medium5.3IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 is vulnerable to a denial of service as the server may crash underCheck if you run itEPSS 0.34%May 29, 2025
- Medium5.3IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 through 11.5.9 and 12.1.0 through 12.1.1 could allow an authenticated user to cause a denial of service wheCheck if you run itEPSS 0.38%May 29, 2025
- Medium6.5Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page.Check if you run itEPSS 0.42%May 27, 2025
- Medium5.4Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin data via a crafted HTML page.Check if you run itEPSS 0.34%May 27, 2025
- High8.8Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.Check if you run itEPSS 3.62%May 27, 2025
- Critical9.3Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network.Check this weekEPSS 49.00%May 27, 2025
- High7.8In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a local directory to run arbitrary code withCheck this weekEPSS 16.00%May 23, 2025
- High7.0When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network Monitor versions prior to 6.5.1 did not enforce secure permissions for sub-direCheck this weekEPSS 15.00%May 23, 2025
- Medium6.0DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.Check this weekEPSS 23.00%May 23, 2025
- Medium6.1DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.Check this weekEPSS 28.00%May 23, 2025
- Low3.5DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem.Check this weekEPSS 24.00%May 23, 2025
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sftranna EC Authorize.net ec-authorizenet allows Reflected XSS.This issue affeCheck if you run itEPSS 0.27%May 23, 2025
- Critical9.8Deserialization of Untrusted Data vulnerability in CoinPayments CoinPayments.net Payment Gateway for WooCommerce coinpayments-payment-gateway-for-woocommerce allows Object InjectioCheck if you run itEPSS 0.46%May 23, 2025
- Medium6.9Windows permissions for ASPECT configuration toolsets are not fully secured allow-ing exposure of configuration informationThis issue affects ASPECT-Enterprise: through 3.*; NEXUSCheck this weekEPSS 15.00%May 22, 2025
- Medium5.5Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems.Check this weekEPSS 22.00%May 22, 2025