Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently.Check if you run itEPSS 0.42%Oct 8, 2026
- Medium6.1When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.Check if you run itEPSS 0.20%Oct 8, 2026
- High7.8Checksum database bypass for golang.org/toolchain in cmd/goCheck if you run itEPSS 0.10%Oct 8, 2026
- High7.8Checksum bypass for golang.org/fips140 in cmd/goCheck if you run itEPSS 0.09%Oct 8, 2026
- UnknownMemory limit bypass when parsing MIME headers in net/textproto, mime/multipartCheck if you run itEPSS 0.40%Oct 8, 2026
- UnknownLack of limit on size of parsed Range headers in net/httpCheck if you run itEPSS 0.38%Oct 8, 2026
- UnknownDouble flow control refund on HTTP/2 server streams in net/httpCheck if you run itEPSS 0.57%Oct 8, 2026
- HighHTTP/2 transport accepts malformed framing-related headers in net/httpCheck if you run itEPSS 0.30%Oct 8, 2026
- UnknownHTTP/2 server memory exhaustion due to Trailer headers in net/httpCheck if you run itEPSS 0.57%Oct 8, 2026
- HighHTTP/1 client connection desynchronization after CONNECT rejection in net/httpCheck if you run itEPSS 0.31%Oct 8, 2026
- CriticalHazelcast allows arbitrary member memory access by low-privileged clientCheck if you run itEPSS 0.38%Oct 8, 2026
- Medium4.4Indico: Cross-Site-Scripting in minutes editorCheck if you run itEPSS 0.23%Oct 8, 2026
- HighHazelcast has an authorization bypass in IMap Predicates APICheck if you run itEPSS 0.39%Oct 8, 2026
- High7.1PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypassCheck if you run itEPSS 0.46%Oct 8, 2026
- High7.4MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPESCheck if you run itEPSS 0.44%Oct 8, 2026
- High8.1MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)Check if you run itEPSS 0.45%Oct 8, 2026
- High7.5MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parametersCheck if you run itEPSS 0.39%Oct 8, 2026
- Medium5.9MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLSCheck if you run itEPSS 0.24%Oct 8, 2026
- HighCairoSVG: Quadratic-time DoS parsing a crafted SVGCheck if you run itEPSS 0.38%Oct 8, 2026
- UnknownPraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDLCheck if you run itEPSS 0.70%Oct 8, 2026
- LowPydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted whenCheck if you run itEPSS 0.30%Oct 8, 2026
- Medium6.8AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)Check if you run itEPSS 0.30%Oct 8, 2026
- Medium6.8AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSCheck if you run itEPSS 0.36%Oct 8, 2026
- High7.5AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabledCheck if you run itEPSS 0.43%Oct 8, 2026
- High7.4AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsCheck if you run itEPSS 0.19%Oct 8, 2026