Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.5Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing ja…Check if you run itEPSS 0.28%Oct 12, 2026
- High8.4Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by up…Check if you run itEPSS 0.25%Oct 12, 2026
- High8.6Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's sessio…Check if you run itEPSS 0.14%Oct 12, 2026
- Low2.3Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base collaborators keep file acc…Check if you run itEPSS 0.20%Oct 12, 2026
- Medium4.8ImageMagick 7.1.0-21 before 7.1.2-32 contains a heap buffer over-read in its handling of the -fx option, where a certain -fx operation reads beyond the bounds of an al…Check if you run itEPSS 0.12%Oct 12, 2026
- Low2.0ImageMagick 7.1.0-20 before 7.1.2-32 contains a use after free vulnerability in the -fx option that occurs when a memory allocation fails during a specific operation.Check if you run itEPSS 0.11%Oct 12, 2026
- Medium4.8ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling.Check if you run itEPSS 0.13%Oct 12, 2026
- Medium6.9ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw in the JNG decoder that fails to remove temporary files when processing crafted input.Check if you run itEPSS 0.38%Oct 12, 2026
- Medium6.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a code injection vulnerability in the MVG decoder when a PostScript renderer is used.Check if you run itEPSS 0.34%Oct 12, 2026
- Medium6.3ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached.Check if you run itEPSS 0.35%Oct 12, 2026
- Medium6.3ImageMagick 7.1.2-30 before 7.1.2-32 contains a use after free vulnerability in the WBINFO decoder that occurs when a memory allocation fails during image decoding.Check if you run itEPSS 0.37%Oct 12, 2026
- Medium4.8ImageMagick before 7.1.2-32 contains a memory leak vulnerability in the -process option that allows attackers to cause unreleased memory allocations by supplying certain arguments.Check if you run itEPSS 0.12%Oct 12, 2026
- Medium6.9ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion.Check if you run itEPSS 0.42%Oct 12, 2026
- Medium6.9ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when…Check if you run itEPSS 0.30%Oct 12, 2026
- Medium6.9ImageMagick 7.1.1-7 before 7.1.2-32 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory due to incorrect string termin…Check if you run itEPSS 0.37%Oct 12, 2026
- Medium6.9ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images.Check if you run itEPSS 0.38%Oct 12, 2026
- Medium6.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the GIF encoder because allocated memory is not released when color quantization fails d…Check if you run itEPSS 0.37%Oct 12, 2026
- Medium6.3ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the PNG encoder, which does not release allocated memory when libpng initialization fails.Check if you run itEPSS 0.37%Oct 12, 2026
- High8.2FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure.Check if you run itEPSS 0.32%Oct 12, 2026
- Medium6.0FreeRDP 3.10.0 through 3.32.2 contains a heap buffer overflow in the WinPR png_write_data callback that writes past the buffer after a realloc failure.Check if you run itEPSS 0.26%Oct 12, 2026
- Medium6.1FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer ove…Check if you run itEPSS 0.46%Oct 12, 2026
- Medium6.0FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncate…Check if you run itEPSS 0.23%Oct 12, 2026
- Medium6.0FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowS…Check if you run itEPSS 0.24%Oct 12, 2026
- High7.0FreeRDP 3.0.0 before 3.32.0 contains a heap buffer overflow vulnerability in collect_keys() that allows local attackers to write past the fixed 64-entry keys array dur…Check if you run itEPSS 0.17%Oct 12, 2026
- Low2.1FreeRDP before 3.32.0 contains a path traversal vulnerability in convert_filedescriptors_to_file_list() in winpr/libwinpr/clipboard/synthetic_file.c, which concatenate…Check if you run itEPSS 0.22%Oct 12, 2026
Sort