Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.6Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source.Check if you run itEPSS 0.83%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting a…Check if you run itEPSS 0.22%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attribute…Check if you run itEPSS 0.30%Oct 13, 2026
- High8.7Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path.Check if you run itEPSS 0.43%Oct 13, 2026
- High7.0Time-of-check time-of-use (toctou) race condition in Linux Kernel allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.21%Oct 13, 2026
- High8.4Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allows compromised cluster work…Check if you run itEPSS 0.34%Oct 13, 2026
- Medium5.3Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBAC catalog by querying unpro…Check if you run itEPSS 0.33%Oct 13, 2026
- High7.0Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to…Check if you run itEPSS 0.51%Oct 13, 2026
- Critical9.3Xorbits Xoscar through 0.11.2 contains an unauthenticated deserialization vulnerability that allows remote attackers to execute arbitrary code by sending crafted data…Check if you run itEPSS 0.85%Oct 13, 2026
- High8.6ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.Check if you run itEPSS 0.45%Oct 13, 2026
- High7.7ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.Check if you run itEPSS 0.47%Oct 13, 2026
- Medium5.4Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be susceptible to a Cross-Site Scripting (XSS) vulnerability, which is a type of issue wher…Check if you run itEPSS 0.17%Oct 13, 2026
- Medium6.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to ob…Check if you run itEPSS 0.29%Oct 13, 2026
- Medium4.3IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.Check if you run itEPSS 0.21%Oct 13, 2026
- Medium5.4IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.Check if you run itEPSS 0.18%Oct 13, 2026
- UnknownImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow.Check if you run itEPSS 0.36%Oct 13, 2026
- Medium5.3Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by…Check if you run itEPSS 0.26%Oct 13, 2026
- Low3.5Indico is a feature-rich event management system.Check if you run itEPSS 0.26%Oct 13, 2026
- High7.0NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths.Check if you run itEPSS 0.32%Oct 13, 2026
- Medium6.0FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential dele…Check if you run itEPSS 0.27%Oct 13, 2026
- Medium6.0The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiat…Check if you run itEPSS 0.32%Oct 13, 2026
- Medium6.9FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows ma…Check if you run itEPSS 0.36%Oct 13, 2026
- Medium5.3FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths.Check if you run itEPSS 0.28%Oct 13, 2026
- High7.1FreeRDP 3.0.0 before 3.32.0 contains an improper restriction of excessive authentication attempts in its virtual smartcard GIDS implementation, which stores the PIN re…Check if you run itEPSS 0.41%Oct 13, 2026
- Medium5.3FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory.Check if you run itEPSS 0.29%Oct 13, 2026
Sort