Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized d…Check if you run itEPSS 0.27%Oct 13, 2026
- Medium5.4When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the request…Check if you run itEPSS 0.21%Oct 13, 2026
- Medium5.3When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request…Check if you run itEPSS 0.28%Oct 13, 2026
- Critical10.0ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.Check if you run itEPSS 0.70%Oct 13, 2026
- Medium6.0FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body.Check if you run itEPSS 0.25%Oct 13, 2026
- High7.1FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes…Check if you run itEPSS 0.32%Oct 13, 2026
- High7.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.51%Oct 13, 2026
- High7.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.51%Oct 13, 2026
- UnknownMalicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)Open the advisoryOct 13, 2026
- Low3.7fastify vulnerable to header validation bypass via case-sensitive propertyNamesCheck if you run itEPSS 0.26%Oct 13, 2026
- Medium5.5A vulnerability was determined in conductor-oss conductor up to 3.32.5.Check if you run itEPSS 0.35%Oct 13, 2026
- UnknownMerge pull request #825 from eliashaeussler/typo3-core-2026-10Check if you run itEPSS 0.51%Oct 13, 2026
- Critical10.0The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases.Check this weekEPSS 39.00%Oct 13, 2026
- Medium6.1ZDI-26-755: (0Day) Genesis World glTF Server-Side Request Forgery VulnerabilityOpen the advisoryOct 13, 2026
- Critical9.3Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint…Check if you run itEPSS 0.35%Oct 13, 2026
- Medium5.3A flaw has been found in PaddlePaddle PaddleX up to 3.7.2.Check if you run itEPSS 0.40%Oct 13, 2026
- Medium4.2GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions,…Check if you run itEPSS 0.13%Oct 13, 2026
- Low1.9A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4.Check if you run itEPSS 0.11%Oct 13, 2026
- Low3.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain condition…Check if you run itEPSS 0.19%Oct 13, 2026
- High8.8SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query.Check if you run itEPSS 0.35%Oct 13, 2026
- Critical10.0The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.Check if you run itEPSS 0.27%Oct 13, 2026
- Critical9.8The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet.Check if you run itEPSS 0.37%Oct 13, 2026
- Medium5.9The Bluetooth host's ATT transmit path releases a buffer it does not own when signing fails.Check if you run itEPSS 0.16%Oct 13, 2026
- Medium5.7The Bluetooth Mesh Access layer delayable-message machinery in subsys/bluetooth/mesh/delayable_msg.c manages a static pool of CONFIG_BT_MESH_ACCESS_DELAYABLE_MSG_COUNT…Check if you run itEPSS 0.18%Oct 13, 2026
- Medium5.5A vulnerability has been found in EricLBuehler mistral.rs up to 0.9.3.Check if you run itEPSS 0.47%Oct 13, 2026