Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.2FreeRDP from 3.0.0-beta1 before 3.32.0 fails to enforce cumulative or absolute size limits when reassembling RDPDR channel fragments in the proxy.Oct 14, 2026
- High7.1FreeRDP from 2.0.0 before 3.32.0 contains a memory exhaustion vulnerability in wts_read_drdynvc_data_first that allows authenticated clients to force servers to commit…Oct 14, 2026
- High8.2FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors.Oct 14, 2026
- High8.2Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply ParsingOct 14, 2026
- High7.1Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding.Oct 14, 2026
- Medium6.9The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP).Oct 14, 2026
- High8.7Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle o…Oct 14, 2026
- Medium6.0RabbitMQ is a messaging and streaming broker.Oct 14, 2026
- High8.2Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.Oct 14, 2026
- Medium4.3Gitea does not limit the length of the gitignores field accepted by repository-creation forms and the API.Oct 14, 2026
- Medium6.5Gitea's Swift package parser limits each manifest to 128 KiB but does not limit the number of manifests or their aggregate size before reading them into memory.Oct 14, 2026
- Medium6.5Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts.Oct 14, 2026
- UnknownGitea's initial GitLab migration version probe uses an HTTP client without a timeout and does not attach the migration task's cancellation context.Oct 14, 2026
- Medium6.5Gitea's OneDev migration downloader reads the entire remote version response into memory without a size limit and uses a client without a timeout.Oct 14, 2026
- Medium6.5svg-sanitizer is a PHP SVG/XML sanitizer.Oct 14, 2026
- High8.7Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.Oct 14, 2026
- High7.5An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service.Oct 14, 2026
- High8.8Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.EPSS 0.7%Oct 13, 2026
- High7.5CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.EPSS 0.6%Oct 13, 2026
- High7.5CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.EPSS 0.5%Oct 13, 2026
- High7.5CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.EPSS 0.5%Oct 13, 2026
- High7.5CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.EPSS 0.6%Oct 13, 2026
- High7.5CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.EPSS 0.5%Oct 13, 2026
- Medium6.5IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception.EPSS 0.3%Oct 13, 2026
- High7.5ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.EPSS 0.9%Oct 13, 2026
73 records · page 1 of 3
PreviousNext