Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownMalicious code in ton-jetton-tools (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in wallet-hd-derive (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in perp-funding-rates (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in block-explorer-api (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in xrp-ledger-utils (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in sol-mint-utils (RubyGems)Open the advisoryOct 11, 2026
- Medium6.9Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoSCheck if you run itEPSS 0.14%Oct 10, 2026
- UnknownSecurity update for python311Open the advisoryOct 10, 2026
- UnknownSecurity update for busyboxOpen the advisoryOct 10, 2026
- UnknownSecurity update for containerdOpen the advisoryOct 10, 2026
- Critical9.1ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the targetOpen the advisoryOct 10, 2026
- UnknownMalicious code in agent-vx (PyPI)Open the advisoryOct 10, 2026
- High7.5Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement updateOpen the advisoryOct 10, 2026
- UnknownMalicious code in media-manager5 (PyPI)Open the advisoryOct 10, 2026
- UnknownMalicious code in agentaix (PyPI)Open the advisoryOct 10, 2026
- UnknownMalicious code in passwordcracker (npm)Open the advisoryOct 10, 2026
- UnknownMalicious code in passwordcrackv2 (npm)Open the advisoryOct 9, 2026
- High7.2Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set.Open the advisoryOct 9, 2026
- Medium5.3Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission checkOpen the advisoryOct 9, 2026
- Medium5.4Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.Open the advisoryOct 9, 2026
- High7.1Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created.Open the advisoryOct 9, 2026
- Medium5.4Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenantsOpen the advisoryOct 9, 2026
- High7.1Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushesOpen the advisoryOct 9, 2026
- Medium5.3Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabledCheck if you run itEPSS 0.26%Oct 9, 2026
- Medium5.3Contao: The registration module re-sends activation mailsCheck if you run itEPSS 0.26%Oct 9, 2026