Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownMalicious code in pyyi (PyPI)Open the advisoryOct 12, 2026
- High7.5A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode.Check if you run itEPSS 0.13%Oct 12, 2026
- UnknownSecurity update for opensshOpen the advisoryOct 12, 2026
- Medium5.4An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack.Check if you run itEPSS 0.12%Oct 12, 2026
- Medium6.8A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak.Check if you run itEPSS 0.25%Oct 12, 2026
- Low1.2A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0.Check if you run itEPSS 0.18%Oct 12, 2026
- Critical9.4Authentication Bypass via Spoofed Remote-User Header in HTTP Basic AuthenticationCheck if you run itEPSS 0.39%Oct 12, 2026
- Medium4.3Cross-Site Request Forgery in Administrative ActionsCheck if you run itEPSS 0.14%Oct 12, 2026
- Medium5.4An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package.Check if you run itEPSS 0.15%Oct 12, 2026
- Medium5.3A vulnerability was identified in yangzongzhuan RuoYi 4.8.3.Check if you run itEPSS 0.21%Oct 12, 2026
- Low2.1A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5.Check if you run itEPSS 0.20%Oct 12, 2026
- High7.8The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte count straight to the vendor SDK routine TRNG_GetRandomData().Check if you run itEPSS 0.11%Oct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to del…Check if you run itEPSS 0.21%Oct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI ch…Open the advisoryOct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify us…Check if you run itEPSS 0.19%Oct 11, 2026
- High8.8AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 serv…Check if you run itEPSS 0.32%Oct 11, 2026
- High8.7mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sen…Open the advisoryOct 11, 2026
- Medium6.9Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecti…Check if you run itEPSS 0.24%Oct 11, 2026
- Medium6.9Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint.Check if you run itEPSS 0.32%Oct 11, 2026
- Medium4.8GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before…Open the advisoryOct 11, 2026
- Low2.3Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenI…Open the advisoryOct 11, 2026
- Medium5.3Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocat…Open the advisoryOct 11, 2026
- High8.2Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private a…Check if you run itEPSS 0.29%Oct 11, 2026
- Medium5.3LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callb…Check if you run itEPSS 0.28%Oct 11, 2026
- Low2.1A vulnerability was found in 021is elvix-sdk up to 0.10.1.Check if you run itEPSS 0.20%Oct 11, 2026