Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.8kernel: macvlan: fix possible UAF in macvlan_forward_source()Sep 11, 2026
- Medium5.1A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of the anti-CSRF token.EPSS 0.1%Sep 8, 2026
- Medium5.4An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges.EPSS 0.4%Sep 8, 2026
- High7.5Disabled and non-configurable certificate/host key validation in Smart Polling in Guardian/CMC before 26.3.0 and Arc before v2.7.0EPSS 0.2%Sep 8, 2026
- High7.4An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges.EPSS 0.4%Sep 8, 2026
- Medium5.1A template injection vulnerability was discovered in the Dashboards functionality due to improper validation of an input parameter.EPSS 0.3%Sep 8, 2026
- Medium6.0Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0Aug 11, 2026
- Medium5.2Npcap driver installed without administrator-only access restriction on Windows in Arc before v2.7.0Aug 11, 2026
- High8.1Incorrect privilege assignment for Arc sensors in Guardian/CMC before 26.2.0Jul 7, 2026
- High8.1Axios is a promise based HTTP client for the browser and Node.js.Apr 10, 2026
- High8.6basic-ftp is an FTP client for Node.js.Apr 9, 2026
- High7.0Axios is a promise based HTTP client for the browser and Node.js.EPSS 1.2%Apr 9, 2026
- High8.2A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM).Apr 7, 2026
- Critical9.8lodash vulnerable to Code Injection via imports key namesEPSS 2.6%Mar 31, 2026
- High7.5Node.js: Node.js: Denial of Service due to crafted HTTP headerEPSS 25.0%Mar 30, 2026
- High7.5A flaw was found in libarchive.EPSS 1.4%Mar 30, 2026
- Critical9.1Forge (also called ) is a native implementation of Transport Layer Security in JavaScript.Mar 27, 2026
- High7.5Forge (also called ) is a native implementation of Transport Layer Security in JavaScript.Mar 27, 2026
- High7.5Forge (also called ) is a native implementation of Transport Layer Security in JavaScript.Mar 27, 2026
- High7.5Forge (also called ) is a native implementation of Transport Layer Security in JavaScript.Mar 27, 2026
- High7.5Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as .Mar 26, 2026
- High7.3Vim is an open source, command line text editor.Mar 24, 2026
- Critical9.8flatted is a circular JSON parser.Mar 20, 2026
- Critical9.1gRPC-Go is the Go language implementation of gRPC.Mar 20, 2026
- High7.1The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.Mar 20, 2026