Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.1BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup int…Check if you run itEPSS 0.36%Oct 14, 2026
- High8.6Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, contains an Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerabilit…Check if you run itEPSS 0.42%Oct 14, 2026
- High7.5Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).Check if you run itEPSS 0.21%Oct 14, 2026
- High8.7An authentication and authorization bypass vulnerability exists in F5 NGINX Kubernetes Ingress Controller (NIC) when configured with the policy or Ingress external authentication.Check if you run itEPSS 0.39%Oct 14, 2026
- Medium5.9Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_…Check if you run itEPSS 0.39%Oct 14, 2026
- High7.5An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service.Check if you run itEPSS 0.42%Oct 14, 2026
- High7.5Important: python-tornado security updateOpen the advisoryOct 14, 2026
- High7.8Important: kernel security, bug fix, and enhancement updateOpen the advisoryOct 14, 2026
- High7.5Remote DoS through unchecked allocation in negentropyOpen the advisoryOct 14, 2026
- Low3.7Unauthenticated ServerHello can downgrade later connections to classical key exchangeOpen the advisoryOct 14, 2026
- Low3.7Brotli certificate decompression can allocate up to 1 GiB before authenticationOpen the advisoryOct 14, 2026
- Low2.3Buffered application data sent to outer server after ECH rejectionOpen the advisoryOct 14, 2026
- Medium4.0impls for client session values expose TLS secretsOpen the advisoryOct 14, 2026
- UnknownSecurity update for the Linux KernelOpen the advisoryOct 14, 2026
- HighGitea SSRF through Git HTTP redirects in mirrors and fetchesCheck if you run itEPSS 0.26%Oct 14, 2026
- Medium5.3The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated atta…Check if you run itEPSS 0.24%Oct 14, 2026
- High8.8The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in an…Check if you run itEPSS 0.46%Oct 14, 2026
- Medium5.3The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result…Check if you run itEPSS 0.24%Oct 14, 2026
- High7.5Important: python-tornado security updateOpen the advisoryOct 14, 2026
- Medium4.7The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to…Check if you run itEPSS 0.24%Oct 14, 2026
- Unknownjfrog-cli-2.127.0-1.1 on GA mediaOpen the advisoryOct 14, 2026
- MediumCVE-2026-98420: ksmbd: follow SMB2 session expiration semanticsCheck if you run itEPSS 0.24%Oct 14, 2026
- Highsmb: client: fix missing iov bounds check in parse_posix_sids()Check if you run itEPSS 0.21%Oct 14, 2026
- UnknownImportant: kernel-rt security, bug fix, and enhancement updateOpen the advisoryOct 14, 2026
- UnknownImportant: kernel security, bug fix, and enhancement updateOpen the advisoryOct 14, 2026