Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.7OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions.Check if you run itEPSS 0.18%Oct 10, 2026
- High8.7SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take…Check if you run itEPSS 0.30%Oct 10, 2026
- High7.1AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the…Check if you run itEPSS 0.24%Oct 10, 2026
- High8.2SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser mid…Check if you run itEPSS 0.58%Oct 10, 2026
- Medium5.3Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asse…Check if you run itEPSS 0.20%Oct 10, 2026
- Medium6.9Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds.Check if you run itEPSS 0.22%Oct 10, 2026
- UnknownExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list.Check if you run itEPSS 0.36%Oct 10, 2026
- UnknownExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument.Check if you run itEPSS 0.39%Oct 10, 2026
- UnknownExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list.Check if you run itEPSS 0.38%Oct 10, 2026
- Critical9.1ZipStreamReader::extract() and ZipArchive::extract() apply Unix permissions through symlinks without confining the targetOpen the advisoryOct 10, 2026
- UnknownMalicious code in agent-vx (PyPI)Open the advisoryOct 10, 2026
- UnknownMalicious code in pafer (PyPI)Open the advisoryOct 10, 2026
- High7.5Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement updateOpen the advisoryOct 10, 2026
- High8.1Red Hat Security Advisory: Red Hat Hardened Images RPMs Security UpdateOpen the advisoryOct 10, 2026
- Medium5.4In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value…Check if you run itEPSS 0.13%Oct 10, 2026
- Medium5.4In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as…Check if you run itEPSS 0.13%Oct 10, 2026
- UnknownMalicious code in media-manager5 (PyPI)Open the advisoryOct 10, 2026
- UnknownMalicious code in agentaix (PyPI)Open the advisoryOct 10, 2026
- Medium6.4The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen pos…Check if you run itEPSS 0.19%Oct 10, 2026
- High8.4ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c.Check if you run itEPSS 0.14%Oct 10, 2026
- UnknownSecurity exception in org.htmlunit.cyberneko.HTMLTagBalancer.reopenFormattingElementsOpen the advisoryOct 10, 2026
- Critical9.8In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functionsCheck if you run itEPSS 0.32%Oct 10, 2026
- UnknownMalicious code in passwordcracker (npm)Open the advisoryOct 10, 2026
- UnknownUse-of-uninitialized-value in processHandshakeTLSBlockOpen the advisoryOct 10, 2026
- UnknownCVE-2026-18524Open the advisoryOct 9, 2026
Sort