Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.2LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently d…Check if you run itEPSS 0.24%Oct 11, 2026
- Medium4.8GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before…Open the advisoryOct 11, 2026
- High7.3pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening projects.Open the advisoryOct 11, 2026
- Low2.0answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without reso…Open the advisoryOct 11, 2026
- High8.6Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients w…Open the advisoryOct 11, 2026
- High8.7MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSo…Check if you run itEPSS 0.36%Oct 11, 2026
- Medium6.9Studio-Saelix Sencho Login Endpoint login improper authenticationCheck if you run itEPSS 0.42%Oct 11, 2026
- Medium5.3argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API en…Check if you run itEPSS 0.29%Oct 10, 2026
- UnknownMalicious code in agent-vx (PyPI)Open the advisoryOct 10, 2026
- UnknownMalicious code in media-manager5 (PyPI)Open the advisoryOct 10, 2026
- UnknownMalicious code in agentaix (PyPI)Open the advisoryOct 10, 2026
- High7.1Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushesOpen the advisoryOct 9, 2026
- Critical9.3Contao: Cross-site scripting in the comments bundleCheck if you run itEPSS 0.27%Oct 9, 2026
- UnknownSecurity update for openssl-3Open the advisoryOct 9, 2026
- Critical9.1The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity.Check if you run itEPSS 0.37%Oct 9, 2026
- Critical9.1In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not verify that the hostname in the server’s TLS certificate matched the…Check if you run itEPSS 0.20%Oct 9, 2026
- High8.2Uncontrolled RecursionCheck if you run itEPSS 0.39%Oct 9, 2026
- Critical9.2An improper authentication vulnerability in the is_authenticated function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthenticated attacker to e…Check if you run itEPSS 0.48%Oct 9, 2026
- UnknownCVE-2026-97032 affecting package python-tensorboard 2.16.2-6Open the advisoryOct 8, 2026
- UnknownCVE-2026-97032 affecting package golang 1.27.1-1Open the advisoryOct 8, 2026
- UnknownCVE-2026-78663 affecting package python-tensorboard 2.16.2-6Open the advisoryOct 8, 2026
- UnknownCVE-2026-78663 affecting package golang 1.27.1-1Open the advisoryOct 8, 2026
- UnknownCVE-2026-78663 affecting package golang 1.26.7-1Open the advisoryOct 8, 2026
- High7.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently.Check if you run itEPSS 0.42%Oct 8, 2026
- UnknownReject malformed ECH outer extension references in crypto/tlsCheck if you run itEPSS 0.39%Oct 8, 2026