Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.8Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.27%May 12, 2026
- High8.2Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Machine Learning allows an unauthorized attacker to perform…Check if you run itEPSS 0.50%May 12, 2026
- Critical9.9Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.66%May 12, 2026
- Critical9.1The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implem…Check if you run itEPSS 0.48%May 12, 2026
- High8.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Check this weekEPSS 31.12%May 12, 2026
- High8.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.Check if you run itEPSS 1.97%May 12, 2026
- Medium4.4Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally.Check if you run itEPSS 0.20%May 12, 2026
- High7.8External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.29%May 12, 2026
- Medium5.5Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.Check if you run itEPSS 0.47%May 12, 2026
- High7.3Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.Check if you run itEPSS 0.64%May 12, 2026
- Medium4.3A tampering vulnerability exists when .NET Core improperly handles specially crafted files.Check if you run itEPSS 0.71%May 12, 2026
- Medium6.7Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.32%May 12, 2026
- High7.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attacker to e…Check if you run itEPSS 0.30%May 12, 2026
- Medium5.3The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories).Check if you run itEPSS 0.34%May 12, 2026
- Medium6.5The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories/{memory_id}).Check if you run itEPSS 0.39%May 12, 2026
- Medium6.5The mem0 1.0.0 server lacks authentication and authorization controls for its memory reset and table re-creation functionality accessible via the DELETE /memories endpoint.Check if you run itEPSS 0.37%May 12, 2026
- Critical9.1The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset functionality accessible via the DELETE /memories endpoint.Check if you run itEPSS 0.49%May 12, 2026
- Medium6.5The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API endpoint (DELETE /memories).Check if you run itEPSS 0.39%May 12, 2026
- High7.5The mem0 1.0.0 server lacks authentication and authorization controls for its memory management API endpoints.Check if you run itEPSS 0.37%May 12, 2026
- Critical9.8The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization (CWE-502) when loading pre-trained models from HuggingFace Hub.Check if you run itEPSS 0.41%May 12, 2026
- Critical9.8The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) in its model serving component.Check if you run itEPSS 0.50%May 12, 2026
- Critical9.8The Ludwig framework thru 0.10.4 is vulnerable to insecure deserialization (CWE-502) through its predict() method.Check if you run itEPSS 0.60%May 12, 2026
- Critical9.8The llm CLI tool thru 0.27.1 contains a critical code injection vulnerability via its --functions command-line argument.Check if you run itEPSS 0.33%May 12, 2026
- Critical9.8The imgaug library thru 0.4.0 contains an insecure deserialization vulnerability in its BackgroundAugmenter class within the multicore.py module.Check if you run itEPSS 0.47%May 12, 2026
- Critical9.8Horovod thru 0.28.1 contains an insecure deserialization vulnerability (CWE-502) in its KVStore HTTP server component.Check if you run itEPSS 0.69%May 12, 2026
Sort