Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.9libfsapfs through 20260921 contains an integer underflow in libfsapfs_key_encrypted_key_read_data() that allows attackers to trigger heap out-of-bounds reads via craft…Check if you run itEPSS 0.20%Oct 15, 2026
- Medium6.9GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSe…Check if you run itEPSS 0.13%Oct 15, 2026
- Medium6.9libxmp through 4.7.4 contains an off-by-one stack out-of-bounds read vulnerability in the prowizard P61A depacker depack_p61a() in src/loaders/prowizard/p61a.c.Check if you run itEPSS 0.20%Oct 15, 2026
- Medium6.9OpenSlide through 4.0.1 contains a heap out-of-bounds read vulnerability in the MIRAX reader that allows attackers to read past the slide_positions array via crafted S…Check if you run itEPSS 0.13%Oct 15, 2026
- Medium6.8Open Asset Import Library (assimp) through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D binary mesh importer's OgreBinarySerializer::ReadAnima…Check if you run itEPSS 0.13%Oct 15, 2026
- Medium6.8Assimp through 6.0.5 contains a NULL pointer dereference vulnerability in the Ogre3D importer that allows attackers to crash applications via unvalidated bone indices…Check if you run itEPSS 0.20%Oct 15, 2026
- Medium6.9catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked…Check if you run itEPSS 0.13%Oct 15, 2026
- UnknownCVE-2026-111132 affecting package libgxps 0.3.2-1Open the advisoryOct 15, 2026
- Medium6.9catdoc through 0.95 contains an out-of-bounds read vulnerability in the MULRK record handler of process_item() in src/xlsparse.c that allows attackers to read past the…Check if you run itEPSS 0.20%Oct 15, 2026
- Medium6.9CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffe…Check if you run itEPSS 0.13%Oct 15, 2026
- Medium6.9CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the imcompress.c unquantize helpers that allows attackers to read memory before the fit…Check if you run itEPSS 0.13%Oct 15, 2026
- Medium6.9FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying unvalidated SoundFont modula…Check if you run itEPSS 0.20%Oct 15, 2026
- UnknownCVE-2026-111124 affecting package cfitsio 4.0.0-5Open the advisoryOct 15, 2026
- Medium5.1Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Locati…Check if you run itEPSS 0.23%Oct 15, 2026
- Medium6.8AdPlug through 2.4 contains a heap out-of-bounds read vulnerability in CdmoLoader::load() in src/dmo.cpp that allows attackers to read past a heap allocation by supply…Check if you run itEPSS 0.13%Oct 15, 2026
- Medium6.8AdPlug through 2.4 contains an out-of-bounds read vulnerability in src/xsm.cpp that allows attackers to read before note_table by supplying a negative note index.Check if you run itEPSS 0.13%Oct 15, 2026
- Medium6.9AdPlug through 2.4 contains a heap-based buffer overflow in CksmPlayer::update() in src/ksm.cpp that writes past the fixed databuf[2048] array without bounds checking.Check if you run itEPSS 0.14%Oct 15, 2026
- High7.5Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize() without class restrictions…Check if you run itEPSS 0.51%Oct 15, 2026
- Medium5.9undici is an HTTP client library for Node.js.Check if you run itEPSS 0.31%Oct 15, 2026
- Medium5.9undici is an HTTP client library for Node.js.Check if you run itEPSS 0.31%Oct 15, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.Th…Check if you run itEPSS 0.16%Oct 15, 2026
- Medium5.9undici is an HTTP client library for Node.js.Check if you run itEPSS 0.25%Oct 15, 2026
- High7.4undici is an HTTP client library for Node.js.Check if you run itEPSS 0.18%Oct 15, 2026
- Medium5.4The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub) renders a documentation U…Check if you run itEPSS 0.17%Oct 15, 2026
- Medium6.0temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for.Check if you run itEPSS 0.36%Oct 15, 2026