Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1bt_iso_recv() in subsys/bluetooth/host/iso.c pulled the ISO SDU header (4 bytes) or, when the timestamp flag is set, the timestamped SDU header (8 bytes) from the inbo…Check if you run itEPSS 0.28%Jun 23, 2026
- Medium5.5The Zephyr ext2 filesystem driver (subsys/fs/ext2) trusted the on-disk directory entry fields de_rec_len and de_name_len when walking a directory block.Check if you run itEPSS 0.16%Jun 23, 2026
- High7.5Stack overflow in lopdf via deeply nested PDF objectsOpen the advisoryJun 21, 2026
- Critical10.0iCagenda Unrestricted Upload of File with Dangerous Type VulnerabilityPatch nowKEVEPSS 20.07%Jun 20, 2026
- Highgithubtoplanguages: Command Injection via Issue Title in Discord Notification WorkflowCheck if you run itEPSS 0.53%Jun 19, 2026
- HighUni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requestsCheck if you run itEPSS 0.27%Jun 19, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period.Check if you run itEPSS 0.11%Jun 19, 2026
- UnknownJupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocolCheck if you run itEPSS 0.30%Jun 19, 2026
- UnknownEntire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewindOpen the advisoryJun 19, 2026
- UnknownImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')Patch nowKEVEPSS 0.94%Jun 19, 2026
- Medium6.5libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server oCheck if you run itEPSS 0.65%Jun 18, 2026
- Critical9.6NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing.Check if you run itEPSS 0.35%Jun 18, 2026
- High7.8A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled envirCheck if you run itEPSS 0.16%Jun 18, 2026
- Critical9.2libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field.Check if you run itEPSS 4.02%Jun 17, 2026
- UnknownCVE-2026-55200 affecting package libssh2 for versions less than 1.11.1-3Open the advisoryJun 17, 2026
- UnknownDrupal core - Moderately critical - Gadget chain - SA-CORE-2026-006Check if you run itEPSS 0.35%Jun 17, 2026
- High7.1Zephyr's Bluetooth Classic Hands-Free Profile (HFP) Hands-Free role parser (subsys/bluetooth/host/classic/hfp_hf.c) contains an out-of-bounds write.Check if you run itEPSS 0.28%Jun 17, 2026
- High7.0util-linux is a random collection of Linux utilities.Check if you run itEPSS 0.11%Jun 17, 2026
- UnknownStack-use-after-scope in StreamReader_CApi::wait_for_file_sizeOpen the advisoryJun 17, 2026
- High7.1Zephyr's IPv6 Neighbor Discovery send paths (net_ipv6_send_na, net_ipv6_send_ns, net_ipv6_send_rs in subsys/net/ip/ipv6_nbr.c) updated the per-interface ICMP-sent stat…Check if you run itEPSS 0.37%Jun 16, 2026
- Medium4.8In Zephyr's native IPv4 stack, icmpv4_handle_echo_request() in subsys/net/ip/icmpv4.c builds an echo-reply packet (reply), hands it to net_try_send_data(), and then, o…Check if you run itEPSS 0.23%Jun 16, 2026
- Low3.7In Zephyr's IPv4 IGMP implementation, igmp_send() in subsys/net/ip/igmp.c read the network interface back out of the packet via net_pkt_iface(pkt) after the packet had…Check if you run itEPSS 0.31%Jun 16, 2026
- High7.8Linux Kernel Integer Overflow or WraparoundPatch nowKEVEPSS 0.58%Jun 16, 2026
- Medium6.3On Xtensa targets with CONFIG_USERSPACE and CONFIG_XTENSA_MMU, the page-table code (arch/xtensa/core/ptables.c) maintains a global list, xtensa_domain_list, of active…Check if you run itEPSS 0.16%Jun 16, 2026
- High7.1An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad.Check if you run itEPSS 0.63%Jun 15, 2026
Sort