Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.8Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy.Check if you run itEPSS 0.17%Oct 21, 2026
- High7.8Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured t…Check if you run itEPSS 0.17%Oct 21, 2026
- High7.0Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials.Check if you run itEPSS 0.26%Oct 21, 2026
- High8.7Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such heade…Check if you run itEPSS 0.26%Oct 21, 2026
- Medium6.9Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding.Check if you run itEPSS 0.22%Oct 21, 2026
- High7.7Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame.Check if you run itEPSS 0.32%Oct 21, 2026
- High7.7Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value.Check if you run itEPSS 0.32%Oct 21, 2026
- Critical9.4Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache.Check if you run itEPSS 0.26%Oct 21, 2026
- Critical10.0Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration.Check if you run itEPSS 0.35%Oct 21, 2026
- High8.8Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API.Check if you run itEPSS 0.23%Oct 21, 2026
- High7.0When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client co…Check if you run itEPSS 0.25%Oct 21, 2026
- Critical9.2Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection paCheck if you run itEPSS 0.24%Oct 21, 2026
- Critical9.1Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including wheCheck if you run itEPSS 0.27%Oct 21, 2026
- UnknownThis module enables you to restrict user logins on a multi-domain site built with the Domain module, so that users can only log in on the domains assigned to them.Open the advisoryOct 21, 2026
- Critical9.2PHP PHP Use After FreePatch nowKEVEPSS 5.99%Oct 21, 2026
- Critical9.2PHP PHP Use After FreePatch nowKEVEPSS 11.62%Oct 21, 2026
- Medium5.4When Thunderbird asked for a security device password (for example a smartcard PIN or the Primary Password) while decrypting an S/MIME message, the message load could…Check if you run itEPSS 0.28%Oct 20, 2026
- Medium5.3When authenticating to a POP3 or SMTP server using NTLM, Thunderbird did not check whether the server's challenge was valid base64.Check if you run itEPSS 0.43%Oct 20, 2026
- Medium5.9When setting up an account, Thunderbird's Exchange AutoDiscover lookup also queried the domain's AutoDiscover service over plain HTTP.Check if you run itEPSS 0.36%Oct 20, 2026
- UnknownThunderbird did not escape attribute values when serializing outgoing XMPP stanzas.Check if you run itEPSS 0.18%Oct 20, 2026
- Medium5.4Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day.Check if you run itEPSS 0.34%Oct 20, 2026
- Medium6.5Denial-of-service in the PDF Viewer component.Check if you run itEPSS 0.35%Oct 20, 2026
- Medium5.4Uninitialized memory in the Audio/Video: cubeb component.Check if you run itEPSS 0.26%Oct 20, 2026
- UnknownIncorrect boundary conditions in the SVG component.Check if you run itEPSS 0.18%Oct 20, 2026
- UnknownREJECTED: CVE-2026-90050: net/sched: fq: clamp quantum and initial_quantum in change pathOpen the advisoryOct 19, 2026