Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3Insufficient input validation vulnerability in Certain NETGEAR routers allows unauthorized accessCheck if you run itEPSS 0.18%Oct 13, 2026
- High7.4Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.Check if you run itEPSS 0.16%Oct 13, 2026
- High7.4Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.Check if you run itEPSS 0.16%Oct 13, 2026
- Medium5.3The auth0/java-jwt library may terminate a thread if it receives a JWT with a timestamp claim (exp, nbf, iat) containing an out-of-range value.Check if you run itEPSS 0.32%Oct 13, 2026
- Medium5.3The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on the directories containing th…Check if you run itEPSS 0.07%Oct 13, 2026
- Medium6.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks.Check if you run itEPSS 0.23%Oct 13, 2026
- High7.1ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.Check if you run itEPSS 0.55%Oct 13, 2026
- High7.6ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.Check if you run itEPSS 0.59%Oct 13, 2026
- Medium6.9Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via un…Check if you run itEPSS 0.34%Oct 13, 2026
- Medium6.9Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent requests.Check if you run itEPSS 0.25%Oct 13, 2026
- High7.1Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass e…Check if you run itEPSS 0.26%Oct 13, 2026
- High7.1Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR.Check if you run itEPSS 0.34%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submittin…Check if you run itEPSS 0.22%Oct 13, 2026
- Medium5.3Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-contro…Check if you run itEPSS 0.29%Oct 13, 2026
- Critical9.4Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation.Check if you run itEPSS 0.37%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by subm…Check if you run itEPSS 0.28%Oct 13, 2026
- Critical9.4Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overw…Check if you run itEPSS 0.55%Oct 13, 2026
- High8.6Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist.Check if you run itEPSS 0.39%Oct 13, 2026
- High8.6Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source.Check if you run itEPSS 0.83%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting a…Check if you run itEPSS 0.22%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attribute…Check if you run itEPSS 0.30%Oct 13, 2026
- High8.7Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path.Check if you run itEPSS 0.34%Oct 13, 2026
- High8.4Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster work…Check if you run itEPSS 0.23%Oct 13, 2026
- Medium5.3Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unpro…Check if you run itEPSS 0.26%Oct 13, 2026
- High7.0Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to…Check if you run itEPSS 0.51%Oct 13, 2026