Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.0util-linux is a random collection of Linux utilities.Check if you run itEPSS 0.18%Oct 14, 2026
- UnknownCVE-2026-53615 affecting package util-linux 2.40.2-6Open the advisoryOct 14, 2026
- High8.2TurboDocx html-to-docx through 1.23.1 contains a server-side request forgery vulnerability that allows attackers supplying HTML to make the server fetch internal URLs…Check if you run itEPSS 0.44%Oct 14, 2026
- High7.8mise manages dev tools like node, python, cmake, and terraform.Check if you run itEPSS 0.19%Oct 14, 2026
- High7.5Discourse is an open-source discussion platform.Check if you run itEPSS 0.48%Oct 14, 2026
- Medium5.3Gitea uses inconsistent repository visibility predicates, and the condition used by some repository-listing endpoints admits repositories whose owners are hidden from the viewer.Check if you run itEPSS 0.36%Oct 14, 2026
- Medium4.3Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission.Check if you run itEPSS 0.29%Oct 14, 2026
- Medium4.3Gitea's organization-list API does not enforce the read:organization token scope.Check if you run itEPSS 0.32%Oct 14, 2026
- Medium4.3Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents.Check if you run itEPSS 0.40%Oct 14, 2026
- Medium4.3Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced…Check if you run itEPSS 0.37%Oct 14, 2026
- Medium6.5Gitea parses Alpine package uploads before enforcing package-size quotas and does not bound the decompressed .PKGINFO data or its dependency and provides entry counts.Check if you run itEPSS 0.55%Oct 14, 2026
- Low3.5Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in…Check if you run itEPSS 0.37%Oct 14, 2026
- Medium4.3Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user.Check if you run itEPSS 0.28%Oct 14, 2026
- Critical9.3The thumbnail Python package through 1.5 contains an OS command injection vulnerability in generate_thumbnail() that allows attackers to execute commands by supplying…Check if you run itEPSS 2.99%Oct 14, 2026
- High8.5@offactory/compress-fonts before 1.1.1 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying font files with crafted names.Check if you run itEPSS 1.15%Oct 14, 2026
- High8.5Turnpress through 0.4.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying .docx files with crafted names.Check if you run itEPSS 1.04%Oct 14, 2026
- Critical9.2Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL.Check if you run itEPSS 2.12%Oct 14, 2026
- Critical9.3Video-stitch before 2.0.0-beta.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying file names interpolated unquoted…Check if you run itEPSS 3.25%Oct 14, 2026
- High8.5Command InjectionCheck if you run itEPSS 1.15%Oct 14, 2026
- High8.7@runnerty/executor-decompress through 3.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted archive file…Check if you run itEPSS 2.51%Oct 14, 2026
- Critical9.3Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.lan…Check if you run itEPSS 2.73%Oct 14, 2026
- Critical9.3@mborne/extract before 0.2.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in archivePath…Check if you run itEPSS 2.73%Oct 14, 2026
- Critical9.3pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths.Check if you run itEPSS 2.35%Oct 14, 2026
- Critical9.3webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled.Check if you run itEPSS 2.52%Oct 14, 2026
- Critical9.2Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255.Check if you run itEPSS 0.43%Oct 14, 2026