Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.4Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.34%May 15, 2026
- High7.1Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.37%May 15, 2026
- High7.6Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.Check if you run itEPSS 0.35%May 15, 2026
- Medium5.3phpMyFAQ before 4.1.2 contains a missing authorization vulnerability in the DELETE /admin/api/content/tags/{tagId} endpoint that allows any authenticated user to delete tags.Check if you run itEPSS 0.30%May 15, 2026
- Medium5.1phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in FAQ creation and update endpoints that bypass sanitization through encode-decode cycles.Check if you run itEPSS 0.26%May 15, 2026
- High7.1phpMyFAQ before 4.1.2 contains an authorization bypass vulnerability in AbstractAdministrationController::userHasPermission() that fails to terminate execution after s…Check if you run itEPSS 0.51%May 15, 2026
- High8.2phpMyFAQ before 4.1.2 contains a stored cross-site scripting vulnerability in search.twig where result.question and result.answerPreview are rendered with the raw filt…Check if you run itEPSS 0.34%May 15, 2026
- High8.7Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores.Check if you run itEPSS 0.34%May 15, 2026
- Critical9.3phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id…Check if you run itEPSS 0.57%May 15, 2026
- Medium5.3Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful.Check if you run itEPSS 0.38%May 15, 2026
- Medium5.3Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful.Check if you run itEPSS 0.38%May 15, 2026
- Medium5.1Podcast Generator 3.1 is vulnerable to persistent cross-site scripting, allowing authenticated attackers to inject malicious scripts by submitting unfiltered JavaScrip…Check if you run itEPSS 0.19%May 15, 2026
- Medium5.1PHP Timeclock 1.04 contains multiple cross-site scripting vulnerabilities that allow unauthenticated attackers to inject arbitrary JavaScript by manipulating URL paths…Check if you run itEPSS 0.21%May 15, 2026
- High8.8PHP Timeclock 1.04 contains time-based and boolean-based blind SQL injection vulnerabilities in the login_userid parameter of login.php that allows unauthenticated att…Check if you run itEPSS 0.27%May 15, 2026
- High8.7WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server resources by sending batched GraphQ…Check if you run itEPSS 0.45%May 15, 2026
- Medium5.3CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files.Check if you run itEPSS 0.24%May 15, 2026
- Medium6.9Traefik is an HTTP reverse proxy and load balancer.Check if you run itEPSS 0.50%May 15, 2026
- Medium5.1Turborepo is a high-performance build system for JavaScript and TypeScript codebases.Check if you run itEPSS 0.18%May 15, 2026
- Critical10.0An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote, unauthenticate…Check if you run itEPSS 0.53%May 15, 2026
- Medium4.3The Notify Odoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1.Check if you run itEPSS 0.20%May 15, 2026
- High8.1The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'admin_h…Check if you run itEPSS 0.50%May 15, 2026
- High8.5Cross-site request forgery vulnerability exists in Musetheque V4 Information Disclosure for IPKNOWLEDGE V4L1 rev2203.0 and earlier.Check if you run itEPSS 0.19%May 15, 2026
- Medium5.3WWW::Mechanize::Cached versions before 2.00 for Perl deserialize cached HTTP responses from a world-writable on-disk cache, enabling local response forgery and code execution.Check if you run itEPSS 0.31%May 15, 2026
- Low2.1The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.Check if you run itEPSS 0.27%May 14, 2026
- Low3.5The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers.Check if you run itEPSS 0.25%May 14, 2026