Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.1FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer ove…Check if you run itEPSS 0.46%Oct 12, 2026
- Medium6.0FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncate…Check if you run itEPSS 0.23%Oct 12, 2026
- Medium6.0FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowS…Check if you run itEPSS 0.24%Oct 12, 2026
- Low2.1FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c, which concatenate…Check if you run itEPSS 0.22%Oct 12, 2026
- High7.1FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored witho…Check if you run itEPSS 0.31%Oct 12, 2026
- High7.1FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 renders uninitialized heap memory from un-decoded progressive tiles because the tile->current buffer is allocated without zeroing.Check if you run itEPSS 0.24%Oct 12, 2026
- Low2.3FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the client video redirection channel that allows malicious servers to crash clients by sendi…Check if you run itEPSS 0.22%Oct 12, 2026
- Low2.3FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious RDP servers to crash clients by sending unvalidat…Check if you run itEPSS 0.22%Oct 12, 2026
- High8.6Crawl4AI from 0.9.0 before 0.9.4 contains an untrusted-config gate bypass that allows non-admin API clients to construct forbidden config objects by wrapping them in d…Check if you run itEPSS 0.32%Oct 12, 2026
- Medium5.1Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.phpCheck if you run itEPSS 0.21%Oct 12, 2026
- Low2.1Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA VerificationCheck if you run itEPSS 0.18%Oct 12, 2026
- Medium6.3Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted QueriesCheck if you run itEPSS 0.22%Oct 12, 2026
- High7.8A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path.Check if you run itEPSS 0.14%Oct 12, 2026
- Unknownhex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25Check if you run itEPSS 0.24%Oct 12, 2026
- UnknownInternal error terms inspected into AshTypescript RPC error responsesCheck if you run itEPSS 0.32%Oct 12, 2026
- UnknownMalicious code in pyyi (PyPI)Open the advisoryOct 12, 2026
- High7.5A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode.Check if you run itEPSS 0.13%Oct 12, 2026
- UnknownSecurity update for opensshOpen the advisoryOct 12, 2026
- Medium6.8A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak.Check if you run itEPSS 0.25%Oct 12, 2026
- High8.8The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22).Check if you run itEPSS 0.41%Oct 12, 2026
- Medium5.1Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data.Check if you run itEPSS 0.14%Oct 12, 2026
- Medium5.3Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs.Check if you run itEPSS 0.28%Oct 11, 2026
- High8.8AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 serv…Check if you run itEPSS 0.32%Oct 11, 2026
- Medium5.3UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary app…Check if you run itEPSS 0.22%Oct 11, 2026
- Medium5.3Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by suppl…Open the advisoryOct 11, 2026