Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.0Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glo…Check if you run itEPSS 0.47%Aug 21, 2026
- Medium6.8Missing Release of Resource after Effective Lifetime vulnerability in Apache CloudStack's scoped global configuration functionality.Check if you run itEPSS 0.59%Aug 21, 2026
- Critical9.3Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header.Check if you run itEPSS 0.61%Aug 21, 2026
- High7.7Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header.Check if you run itEPSS 0.59%Aug 21, 2026
- High8.7Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transa…Check if you run itEPSS 0.51%Aug 21, 2026
- Medium4.6Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66Check if you run itEPSS 0.21%Aug 21, 2026
- Critical9.8In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched.Check if you run itEPSS 0.25%Aug 21, 2026
- Critical9.8SPIP before 4.4.21 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026.Patch nowKEVEPSS 4.48%Aug 21, 2026
- Critical9.8GeoTools is an open source Java library that provides tools for geospatial data.Patch nowKEVEPSS 3.98%Aug 21, 2026
- UnknownMiniOrange saml_sp_single_sign_on Incorrect Privilege AssignmentPatch nowKEVEPSS 0.42%Aug 21, 2026
- UnknownMiniOrange saml_sp_single_sign_on Improper AuthenticationPatch nowKEVEPSS 1.26%Aug 21, 2026
- UnknownUnrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.83%Aug 21, 2026
- UnknownHCSEC-2026-31 - Go-slug vulnerable to exclusion bypass in .terraformignore handlingCheck if you run itEPSS 0.14%Aug 20, 2026
- Medium4.8Coder before 2.34.2 Stored HTML Injection via Appearance SettingsCheck if you run itEPSS 0.17%Aug 20, 2026
- Medium6.3Coder before 2.34.2 User Enumeration via Login Placeholder HashCheck if you run itEPSS 0.22%Aug 20, 2026
- Critical9.9A flaw was found in Lighthouse.Check if you run itEPSS 0.66%Aug 20, 2026
- Medium5.5asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval InterpreterCheck if you run itEPSS 0.13%Aug 20, 2026
- High7.4A flaw was found in WildFly Elytron.Check if you run itEPSS 0.89%Aug 20, 2026
- Critical9.3Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtCamp Inc.Patch nowKEVEPSS 0.40%Aug 20, 2026
- Medium5.8Guest controlled-size host heap allocation through WASIp3 streamsCheck if you run itEPSS 0.17%Aug 20, 2026
- Critical9.6A flaw was found in FreeIPA.Check if you run itEPSS 0.35%Aug 20, 2026
- High7.5A flaw was found in FreeIPA.Check if you run itEPSS 0.54%Aug 20, 2026
- High8.7A privilege escalation flaw was found in FreeIPA.Check if you run itEPSS 0.75%Aug 20, 2026
- High7.5A flaw was found in FreeIPA.Check if you run itEPSS 0.54%Aug 20, 2026
- Medium5.3Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responsesCheck if you run itEPSS 0.23%Aug 20, 2026
Sort