Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.Check if you run itEPSS 0.25%Oct 15, 2026
- UnknownCVE-2026-111269 affecting package libical 3.0.10-1Open the advisoryOct 15, 2026
- Medium6.9MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples.Check if you run itEPSS 0.13%Oct 15, 2026
- Medium6.5Improper Input ValidationCheck if you run itEPSS 0.30%Oct 15, 2026
- High8.8Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.Check if you run itEPSS 0.27%Oct 15, 2026
- High8.8Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.Check if you run itEPSS 0.27%Oct 15, 2026
- High8.8Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.Check if you run itEPSS 0.22%Oct 15, 2026
- High8.8Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.Check if you run itEPSS 0.22%Oct 15, 2026
- High8.8Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page.Check if you run itEPSS 0.18%Oct 15, 2026
- High8.8Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page.Check if you run itEPSS 0.18%Oct 15, 2026
- High8.8Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.Check if you run itEPSS 0.22%Oct 15, 2026
- High8.8Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.Check if you run itEPSS 0.29%Oct 15, 2026
- High7.1ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete RoutesCheck if you run itEPSS 0.25%Oct 15, 2026
- Medium6.1ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete RoutesCheck if you run itEPSS 0.23%Oct 15, 2026
- Medium6.9BillionMail through 4.9 Forgeable JWTs via Default Signing KeyCheck if you run itEPSS 0.26%Oct 15, 2026
- High8.6cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user EndpointsCheck if you run itEPSS 0.42%Oct 15, 2026
- High7.0cool-admin-midway through 8.0.0 Missing Authorization via System Role EndpointsCheck if you run itEPSS 0.26%Oct 15, 2026
- High7.1MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET BranchCheck if you run itEPSS 0.24%Oct 15, 2026
- Critical9.5BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator withCheck if you run itEPSS 0.43%Oct 15, 2026
- UnknownApache Airflow SFTP provider: Async SFTP hook disables host-key verification by defaultCheck if you run itEPSS 0.22%Oct 15, 2026
- MediumApache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement tokenCheck if you run itEPSS 0.34%Oct 15, 2026
- UnknownApache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by defaultCheck if you run itEPSS 0.30%Oct 15, 2026
- UnknownThe Apache Airflow Keycloak provider's multi-team provisioning ( ) granted every team role global read access to audit logs.Check if you run itEPSS 0.26%Oct 15, 2026
- High7.2WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET ParameterCheck if you run itEPSS 0.24%Oct 15, 2026
- High8.8The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment).Check if you run itEPSS 0.35%Oct 15, 2026