Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- HighRabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UICheck if you run itEPSS 0.16%Oct 1, 2026
- High7.5league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scanCheck if you run itEPSS 0.37%Sep 30, 2026
- UnknownA vulnerability was determined in Blosc C-Blosc2 up to 3.3.2.Check if you run itEPSS 0.28%Sep 30, 2026
- UnknownCVE-2026-103111 affecting package rust for versions less than 1.75.0-30Open the advisorySep 30, 2026
- UnknownImportant: nodejs:24 security, bug fix, and enhancement updateOpen the advisorySep 30, 2026
- Medium6.8Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)Check if you run itEPSS 0.38%Sep 29, 2026
- Medium6.1Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationCheck if you run itEPSS 0.31%Sep 29, 2026
- Medium5.9libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computing allocation sizes.Check if you run itEPSS 0.35%Sep 29, 2026
- Unknownurllib3 is an HTTP client library for Python.Check if you run itEPSS 0.29%Sep 29, 2026
- UnknownImproper parsing of fractional NumericDate from JWT exp claimsOpen the advisorySep 29, 2026
- UnknownCVE-2026-100419 affecting package rust for versions less than 1.75.0-30Open the advisorySep 25, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: virtio_ring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit iCheck if you run itEPSS 0.17%Sep 25, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: ppp_async: drop the errored frame instead of resetting its headroom ppp_receive_nonmp_frame() prepends a two-bytCheck if you run itEPSS 0.16%Sep 25, 2026
- High7.5In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvme_scan_ns_list() drops the stale namespaces in each gCheck if you run itEPSS 0.60%Sep 25, 2026
- Medium6.5Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locatiCheck if you run itEPSS 0.40%Sep 25, 2026
- Critical9.1Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentCheck if you run itEPSS 0.39%Sep 25, 2026
- Critical9.1Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCreCheck if you run itEPSS 0.37%Sep 25, 2026
- Unknownperf/x86/intel/pt: Fix stop/start with no updateCheck if you run itEPSS 0.18%Sep 24, 2026
- Critical9.6Red Hat Security Advisory: webkit2gtk3 security updateOpen the advisorySep 22, 2026
- UnknownMalicious code in gemini-computer-use (npm)Open the advisorySep 21, 2026
- UnknownExpat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequences to be accepted.Check if you run itEPSS 0.40%Sep 19, 2026
- UnknownCGA-jcqq-656c-2cm2Open the advisorySep 18, 2026
- UnknownMalicious code in tailwindcss-form (npm)Open the advisorySep 18, 2026
- High7.1WordPress 7.1.1 Maintenance and Security ReleasePatch nowKEVEPSS 0.35%Sep 18, 2026
- Critical9.8NFSv4.1: zero referring call lists before decodingCheck if you run itEPSS 0.61%Sep 17, 2026