Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.1Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lis…EPSS 0.8%Oct 15, 2026
- High8.6pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute co…EPSS 6.5%Oct 15, 2026
- Low2.3Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute comm…EPSS 2.7%Oct 15, 2026
- High7.7pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute c…EPSS 5.4%Oct 15, 2026
- High8.6Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute command…EPSS 0.8%Oct 15, 2026
- High7.5Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submi…EPSS 1.0%Oct 15, 2026
- High7.5Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unesc…EPSS 1.0%Oct 15, 2026
- High8.6pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injectin…EPSS 0.7%Oct 15, 2026
- High7.5Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via un…EPSS 0.9%Oct 15, 2026
- High8.6Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execut…EPSS 8.4%Oct 15, 2026
- High8.6Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute commands as…EPSS 7.1%Oct 15, 2026
- High8.6Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute commands as roo…EPSS 6.5%Oct 15, 2026
- High8.6Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wire…EPSS 7.1%Oct 15, 2026
- High8.6Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by stori…EPSS 8.6%Oct 15, 2026
- Medium6.0@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys.EPSS 0.4%Oct 15, 2026
- Low2.3La Suite Docs through 6.0.0 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access.EPSS 0.3%Oct 15, 2026
- Medium5.1LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Co…EPSS 0.2%Oct 15, 2026
- Medium6.9GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static tabl…EPSS 0.1%Oct 15, 2026
- Medium6.8libmikmod through 3.3.15 contains a heap out-of-bounds read vulnerability in the IMF_Load() loader that allows attackers to read beyond allocated memory by supplying a…EPSS 0.2%Oct 15, 2026
- Medium6.8libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel count is never clamped.EPSS 0.1%Oct 15, 2026
- Medium6.8UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inputs.EPSS 0.1%Oct 15, 2026
- Medium6.8WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in _WM_ParseNewHmi() in src/f_hmi.c that reads past buffers when handling 0xfe sub-events.EPSS 0.2%Oct 15, 2026
- Medium6.9WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowe…EPSS 0.1%Oct 15, 2026
- Medium6.9libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via c…EPSS 0.2%Oct 15, 2026
- High8.7LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_t…EPSS 0.4%Oct 15, 2026