Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.3OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve SearchCheck if you run itEPSS 0.26%Jul 24, 2026
- Unknownlibssh2 through 1.11.1, fixed in commit 42e33d8, contains a pre-authentication heap buffer overflow vulnerability that allows a malicious SSH server to corrupt heap metadata in anyCheck if you run itEPSS 0.47%Jul 24, 2026
- Unknownlibssh2 through 1.11.1, fixed in commit a13bb6c, contains a missing bounds check vulnerability that allows a malicious SSH server to trigger an arbitrary-length heap out-of-boundsCheck if you run itEPSS 0.40%Jul 24, 2026
- Unknownlibssh2 through 1.11.1, fixed in commit a2ed82d, contains a pre-authentication integer underflow vulnerability in the ssh2_cipher_crypt() function in src/openssl.c that allows a maCheck if you run itEPSS 0.58%Jul 24, 2026
- Unknownlibssh2 through 1.11.1, fixed in commit 5e47761, contains a double-free vulnerability in the sftp_open() function in src/sftp.c that allows a malicious SSH server to corrupt the heCheck if you run itEPSS 0.45%Jul 24, 2026
- UnknownImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.25%Jul 24, 2026
- Medium5.1GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers t…Check if you run itEPSS 0.24%Jul 23, 2026
- Medium5.1GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject…Check if you run itEPSS 0.24%Jul 23, 2026
- Medium5.3Missing Authorization vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Exploiting Incorrectly Con…Check if you run itEPSS 0.31%Jul 23, 2026
- Unknownalibaba fastjson Improper Input ValidationPatch nowKEVEPSS 0.66%Jul 23, 2026
- High8.6The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone.Check if you run itEPSS 0.21%Jul 22, 2026
- High7.5A DNSSEC validating resolver that is under a random subdomain attack against a DNSSEC-signed zone can suffer from runaway memory usage.Check if you run itEPSS 0.54%Jul 22, 2026
- High7.5An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ proceCheck if you run itEPSS 0.43%Jul 22, 2026
- Medium6.8BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.Check if you run itEPSS 0.27%Jul 22, 2026
- High7.8traefik traefik Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 0.62%Jul 22, 2026
- UnknownOut of bounds read in GUICheck if you run itEPSS 0.53%Jul 22, 2026
- Medium6.6Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).Check if you run itEPSS 0.36%Jul 21, 2026
- High7.6The Classic (BR/EDR) L2CAP signaling handlers l2cap_br_conf_req() and l2cap_br_conf_rsp() in subsys/bluetooth/host/classic/l2cap_br.c validated the minimum command siz…Check if you run itEPSS 0.16%Jul 21, 2026
- Medium5.5The DesignWare SPI driver (drivers/spi/spi_dw.c) computed the SPI BAUDR clock divider as info->clock_frequency / config->frequency without validating config->frequency.Check if you run itEPSS 0.14%Jul 21, 2026
- High8.1The MCTP-over-I2C+GPIO target binding in Zephyr (subsys/pmci/mctp/mctp_i2c_gpio_target.c) processes pseudo-register writes from an I2C bus master byte-by-byte in mctp_…Check if you run itEPSS 0.39%Jul 21, 2026
- Medium6.5The CONFIG_USERSPACE syscall verifier z_vrfy_k_poll() in kernel/poll.c allocates a kernel-side copy of the user-supplied k_poll_event[] via z_thread_malloc() and then…Check if you run itEPSS 0.14%Jul 21, 2026
- Medium6.5In Zephyr's Bluetooth Mesh PB-ADV provisioning bearer (subsys/bluetooth/mesh/pb_adv.c), prov_msg_recv() rescheduled the provisioning protocol watchdog timer unconditio…Check if you run itEPSS 0.39%Jul 21, 2026
- Medium5.5The NXP LPUART serial driver (drivers/serial/uart_mcux_lpuart.c), when CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled, called LPUART_Deinit() at the start of mcux_lpuart…Check if you run itEPSS 0.14%Jul 21, 2026
- Highsharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591Check if you run itEPSS 0.11%Jul 21, 2026
- Medium6.5jackson-databind: @JsonView bypassed for @JsonUnwrapped container properties on deserializationCheck if you run itEPSS 0.35%Jul 21, 2026
Sort