Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.5music-metadata is a metadata parser for audio and video media files.Check if you run itEPSS 0.21%Oct 8, 2026
- High8.8dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set().Check if you run itEPSS 0.33%Oct 8, 2026
- High8.2Improper validation of a BSON array length in the MongoDB Go Driver can cause an out-of-bounds index and runtime panic when an application calls bson.RawArray.Validate…Check if you run itEPSS 0.24%Oct 8, 2026
- Medium6.0In OpenStack Mistral through 23.0.0, the workflow membership API lets a project that has accepted a share of another project's private workflow create a further member…Check if you run itEPSS 0.26%Oct 8, 2026
- Medium5.3FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redire…Check if you run itEPSS 0.26%Oct 8, 2026
- Medium5.3FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when openin…Check if you run itEPSS 0.32%Oct 8, 2026
- High7.1FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit.Check if you run itEPSS 0.36%Oct 8, 2026
- High7.1FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts…Check if you run itEPSS 0.47%Oct 8, 2026
- Medium6.9Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/corazaCheck if you run itEPSS 0.28%Oct 8, 2026
- Medium5.7FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionIn…Check if you run itEPSS 0.09%Oct 8, 2026
- Medium5.7FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemp…Check if you run itEPSS 0.14%Oct 8, 2026
- Medium4.8FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when…Check if you run itEPSS 0.14%Oct 8, 2026
- Medium6.0FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers.Check if you run itEPSS 0.19%Oct 8, 2026
- Medium6.3FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname che…Check if you run itEPSS 0.14%Oct 8, 2026
- High7.7The ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction — therefore, access t…Check if you run itEPSS 0.37%Oct 8, 2026
- High8.2IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to an XML external ent…Check if you run itEPSS 0.34%Oct 8, 2026
- Critical9.8IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to exe…Check if you run itEPSS 0.38%Oct 8, 2026
- Medium5.9IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cau…Check if you run itEPSS 0.27%Oct 8, 2026
- Critical9.1IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cau…Check if you run itEPSS 0.27%Oct 8, 2026
- High7.7IBM DataPower Gateway 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to cause a denial of service due to improper memory allocation during key derivation.Check if you run itEPSS 0.29%Oct 8, 2026
- Critical9.8IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obt…Check if you run itEPSS 0.40%Oct 8, 2026
- High8.1IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated a…Check if you run itEPSS 0.57%Oct 8, 2026
- High8.2IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cau…Check if you run itEPSS 0.29%Oct 8, 2026
- Medium6.5IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obta…Check if you run itEPSS 0.09%Oct 8, 2026
- Critical9.8IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to a heap-based buffer…Check if you run itEPSS 0.49%Oct 8, 2026
Sort