Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- MediumRabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float expCheck if you run itEPSS 0.34%Oct 1, 2026
- MediumRabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission checkCheck if you run itEPSS 0.43%Oct 1, 2026
- HighRabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UICheck if you run itEPSS 0.15%Oct 1, 2026
- Medium6.1A flaw was found in oauth-proxy.Check if you run itEPSS 0.28%Oct 1, 2026
- Critical9.3The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation.Check if you run itEPSS 0.59%Oct 1, 2026
- High8.8ZDI-26-751: Microsoft Windows dxgkrnl Time-Of-Check Time-Of-Use Local Privilege Escalation VulnerabilityCheck if you run itEPSS 0.29%Oct 1, 2026
- UnknownHeap-buffer-overflow in load_u64Open the advisoryOct 1, 2026
- UnknownRejetto http_file_server Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)Patch nowKEVEPSS 1.91%Oct 1, 2026
- Critical9.8Fortinet FortiMail Path Traversal VulnerabilityPatch nowKEVEPSS 4.57%Oct 1, 2026
- UnknownImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 0.81%Oct 1, 2026
- High8.7pypdf: Possible long runtimes when generating appearance streamsCheck if you run itEPSS 0.34%Sep 30, 2026
- High8.7pypdf: Possible long runtimes/large memory usage when parsing indirect objectsCheck if you run itEPSS 0.34%Sep 30, 2026
- Medium6.1An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size.Check if you run itEPSS 0.28%Sep 30, 2026
- Unknownssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set.Check if you run itEPSS 0.55%Sep 30, 2026
- UnknownA remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context to SSLSocket.context (the documented waCheck if you run itEPSS 0.52%Sep 30, 2026
- High7.5league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scanCheck if you run itEPSS 0.37%Sep 30, 2026
- Low2.1[SECURITY] [DSA 6550-1] ghostscript security updateCheck if you run itEPSS 0.32%Sep 30, 2026
- UnknownA vulnerability was determined in Blosc C-Blosc2 up to 3.3.2.Check if you run itEPSS 0.28%Sep 30, 2026
- Critical9.4LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."Check if you run itEPSS 0.26%Sep 30, 2026
- High8.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection.Check if you run itEPSS 0.25%Sep 30, 2026
- High7.1Crocoblock jetengine Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Patch nowKEVEPSS 0.18%Sep 30, 2026
- High8.5WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerabilityPatch nowKEVEPSS 0.25%Sep 30, 2026
- UnknownCGA-8jhf-237h-xrrqOpen the advisorySep 30, 2026
- High7.8A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded…Check if you run itEPSS 0.17%Sep 30, 2026
- UnknownCGA-4xm9-49vj-r93vOpen the advisorySep 30, 2026
Sort