Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low3.1H3C HDM Family-A verifies the RSA signature of a firmware image against a public key it reads from the mutable file .Check if you run itEPSS 0.10%Oct 13, 2026
- Medium5.5A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5.Check if you run itEPSS 0.26%Oct 13, 2026
- High7.4Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information disclosure via network access.Check if you run itEPSS 0.16%Oct 13, 2026
- High7.4Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access.Check if you run itEPSS 0.16%Oct 13, 2026
- Medium5.3Gotify: Insufficiently Protected Password Change endpointCheck if you run itEPSS 0.34%Oct 13, 2026
- Medium6.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks.Check if you run itEPSS 0.23%Oct 13, 2026
- Medium6.9Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via un…Check if you run itEPSS 0.34%Oct 13, 2026
- Medium5.3Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-contro…Check if you run itEPSS 0.29%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting a…Check if you run itEPSS 0.22%Oct 13, 2026
- High8.7Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path.Check if you run itEPSS 0.34%Oct 13, 2026
- High7.0Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to…Check if you run itEPSS 0.51%Oct 13, 2026
- Medium6.0FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential dele…Check if you run itEPSS 0.22%Oct 13, 2026
- Medium6.0The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiat…Check if you run itEPSS 0.26%Oct 13, 2026
- Medium5.3FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths.Check if you run itEPSS 0.28%Oct 13, 2026
- Medium5.3FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory.Check if you run itEPSS 0.24%Oct 13, 2026
- High7.1FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized d…Check if you run itEPSS 0.27%Oct 13, 2026
- High7.1FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client.Check if you run itEPSS 0.27%Oct 13, 2026
- Medium6.0FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrent…Check if you run itEPSS 0.23%Oct 13, 2026
- High7.1FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points arr…Check if you run itEPSS 0.27%Oct 13, 2026
- High7.1FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header…Check if you run itEPSS 0.27%Oct 13, 2026
- High7.1FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete…Check if you run itEPSS 0.27%Oct 13, 2026
- Medium5.1FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider.Check if you run itEPSS 0.15%Oct 13, 2026
- High7.1Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with…Check if you run itEPSS 0.27%Oct 13, 2026
- Medium6.0FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body.Check if you run itEPSS 0.25%Oct 13, 2026
- High7.1FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes…Check if you run itEPSS 0.32%Oct 13, 2026