Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7MoviePilot 3.1.5 Command Injection via ExecuteCommandToolCheck if you run itEPSS 1.00%Oct 15, 2026
- High7.5A security vulnerability in HPE NonStop SNMP Trap Multiplexer may cause memory corruptionCheck if you run itEPSS 0.26%Oct 15, 2026
- Medium5.3ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.Check if you run itEPSS 0.25%Oct 15, 2026
- High8.7SODOLA SL902-SWTGW124AS Buffer Overflow DoS via Multipart Boundary ParserCheck if you run itEPSS 0.39%Oct 15, 2026
- Low2.8A vulnerability was detected in ggml-org whisper.cpp up to 1.9.4.Check if you run itEPSS 0.12%Oct 15, 2026
- High7.5kin-openapi is a Go project for handling OpenAPI files.Check if you run itEPSS 0.43%Oct 15, 2026
- High7.5Junrar is an open source Java RAR archive library.Check if you run itEPSS 0.40%Oct 15, 2026
- Mediumcontainerd: Unpack DoS via repeated opaque whiteoutsCheck if you run itEPSS 0.21%Oct 15, 2026
- High7.5FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying de…Check if you run itEPSS 0.34%Oct 15, 2026
- Critical10.0Podman: The command can be instructed to disable almost all sandboxing by image annotationCheck if you run itEPSS 0.92%Oct 15, 2026
- Medium5.3MessagePack: Nested arrays can blow past buffer length limitsCheck if you run itEPSS 0.65%Oct 15, 2026
- Unknownninjaforms ninja_forms Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.35%Oct 15, 2026
- Critical9.8The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1.Patch nowKEVEPSS 0.29%Oct 15, 2026
- UnknownA Regular-Expression Denial of Service (ReDoS) in the Markdown2.Check if you run itEPSS 0.15%Oct 15, 2026
- UnknownNginx UI: OTP secure-session step-up can be bypassed via MCP configuration toolsCheck if you run itEPSS 0.35%Oct 15, 2026
- UnknownNginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enableCheck if you run itEPSS 0.21%Oct 15, 2026
- UnknownNginx UI: MCP Bypasses Directive Validation — Authenticated RCECheck if you run itEPSS 0.62%Oct 15, 2026
- UnknownNginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the official image)Check if you run itEPSS 0.38%Oct 15, 2026
- UnknownNginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)Check if you run itEPSS 0.40%Oct 15, 2026
- UnknownNginx UI: Account Takeover via Missing on User Management EndpointCheck if you run itEPSS 0.33%Oct 15, 2026
- High7.7FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared moduleCheck if you run itEPSS 0.23%Oct 15, 2026
- UnknownSliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG DecoderOpen the advisoryOct 15, 2026
- Medium6.5SFTPGo: Denial of service via malformed SSH channel requestCheck if you run itEPSS 0.31%Oct 15, 2026
- High7.1Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode AttributePatch nowKEVEPSS 0.15%Oct 15, 2026
- MediumTerragrunt catalog predictable temp symlink clobberOpen the advisoryOct 15, 2026