Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1Payload is a free and open source headless content management system.Check if you run itEPSS 0.26%Oct 6, 2026
- Critical9.8Dbit WIFI4 N300 1.0.0 devices allow the management interface to be crashed via a request (from the local Wi-Fi network) that lacks a /api/login username or password field.Check if you run itEPSS 0.36%Oct 6, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrm_state_netlink() builds the ALLOCSPI response with dump_oneCheck if you run itEPSS 0.17%Oct 6, 2026
- UnknownImportant: nodejs:22 security updateOpen the advisoryOct 6, 2026
- Medium5.0PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryptionCheck if you run itEPSS 0.13%Oct 5, 2026
- Medium6.5vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied featuresCheck if you run itEPSS 0.27%Oct 5, 2026
- Medium5.3Joomla Extension - joomshaper.com - Reflected XSS in the Dynamic Content Filter addon in SP Page Builder Pro 3.0.0 - 5.6.1p2 - The slider minimum and maximum values ar…Check if you run itEPSS 0.16%Oct 5, 2026
- Medium6.3Joomla Extension - svenbluege.de - Server-side request forgery in the Google Photos picker in Event Gallery extension < 6.6.0Check if you run itEPSS 0.27%Oct 5, 2026
- Medium6.9Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4Check if you run itEPSS 0.29%Oct 5, 2026
- Medium5.1Joomla Extension - svenbluege.de - Cross-site request forgery of list tasks of the backend in Event Gallery extension < 6.6.0Check if you run itEPSS 0.10%Oct 5, 2026
- UnknownD-Link dap-1360_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 2.06%Oct 5, 2026
- UnknownUnrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.59%Oct 2, 2026
- UnknownServer-Side Request Forgery (SSRF)Patch nowKEVEPSS 0.36%Oct 2, 2026
- UnknownImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 0.53%Oct 2, 2026
- High8.4Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier allows an…Check if you run itEPSS 0.13%Oct 1, 2026
- High8.8Integer overflow in mod_dav_fs in Apache HTTP Server through 2.4.68 allows an authenticated WebDAV client with write access to crash worker processes and persistently corrupt a dirCheck if you run itEPSS 0.44%Oct 1, 2026
- High7.5Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') response smuggling vulnerability in Apache HTTP Server via mod_proxy_uwsgi and a crafted uwsgi respCheck if you run itEPSS 0.50%Oct 1, 2026
- High7.5Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of serviceCheck if you run itEPSS 0.88%Oct 1, 2026
- Medium5.3Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows a remote client to read WebCheck if you run itEPSS 0.53%Oct 1, 2026
- Critical9.1Foreman: excessive permissions for viewer role on previewCheck if you run itEPSS 0.32%Oct 1, 2026
- High7.5league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scanCheck if you run itEPSS 0.37%Sep 30, 2026
- Critical9.8Cisco Catalyst SD-WAN Manager Hex Encoding VulnerabilityPatch nowKEVEPSS 1.82%Sep 30, 2026
- UnknownImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 0.55%Sep 30, 2026
- UnknownServer-Side Request Forgery (SSRF)Patch nowKEVEPSS 0.45%Sep 30, 2026
- UnknownImportant: nodejs:24 security, bug fix, and enhancement updateOpen the advisorySep 30, 2026