Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause…Check if you run itEPSS 0.36%May 21, 2026
- Medium5.9Netatalk 1.5.0 through 4.4.2 uses DES-ECB for authentication with a timing side channel, which allows a remote attacker to recover authentication credentials via timing analysis.Check if you run itEPSS 0.39%May 21, 2026
- High7.5An integer underflow in dsi_writeinit() in Netatalk 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI write request.Check if you run itEPSS 0.33%May 21, 2026
- Medium4.5A race condition in the privilege toggle mechanism in Netatalk 2.2.5 through 4.4.2 allows a local attacker to obtain limited information, modify limited data, or cause…Check if you run itEPSS 0.07%May 21, 2026
- High7.2An authentication bypass vulnerability in Netatalk 2.2.2 through 4.4.2 allows a remote privileged user to authenticate as an arbitrary user via the admin auth user mechanism.Check if you run itEPSS 0.53%May 21, 2026
- Medium6.4A stack-based buffer overflow in desktop.c in Netatalk 1.3 through 4.2.2 allows a remote authenticated attacker to cause a denial of service, obtain limited informatio…Check if you run itEPSS 0.25%May 21, 2026
- High7.5A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitrary code.Check if you run itEPSS 0.36%May 21, 2026
- Medium6.5Netatalk 2.0.0 through 4.4.2 generates AFP session tokens derived from predictable process IDs, which allows a remote authenticated attacker to cause a denial of servi…Check if you run itEPSS 0.28%May 21, 2026
- High7.4Netatalk 1.5.0 through 4.2.2 uses a broken cryptographic algorithm in the DHCAST128 UAM, which allows a remote attacker to obtain authentication credentials or imperso…Check if you run itEPSS 0.30%May 21, 2026
- High7.5Netatalk 2.1.0 through 4.4.2 inserts LDAP simple-bind passwords into log output in cleartext, which allows an attacker with access to the log files to obtain LDAP credentials.Check if you run itEPSS 0.24%May 21, 2026
- High8.1An improper link resolution vulnerability in Netatalk 3.0.2 through 4.4.2 allows a remote authenticated attacker to read arbitrary files or overwrite arbitrary files v…Check if you run itEPSS 0.48%May 21, 2026
- Critical9.9A heap-based buffer overflow in the CNID daemon comm_rcv() function in Netatalk 2.0.0 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code wi…Check if you run itEPSS 0.42%May 21, 2026
- High7.5An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrar…Check if you run itEPSS 0.52%May 21, 2026
- High8.8A stack-based buffer overflow via UCS-2 type confusion in convert_charset() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary…Check if you run itEPSS 0.42%May 21, 2026
- High8.8An SQL injection vulnerability in the MySQL CNID backend in Netatalk 3.1.0 through 4.4.2 allows a remote authenticated attacker to obtain unauthorized access to data,…Check if you run itEPSS 0.37%May 21, 2026
- Critical9.8The Avada Builder (fusion-builder) plugin for WordPress is vulnerable to Unauthenticated Remote Code Execution via PHP Function Injection in versions up to and including 3.15.2.Patch nowKEVEPSS 9.88%May 21, 2026
- Medium6.5In mlflow/mlflow versions up to 3.9.0, the REST API endpoint and the GraphQL query lack proper per-model authorization checks when basic authentication is enabled.Check if you run itEPSS 0.44%May 21, 2026
- Medium6.4The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes in all versions up to, and including, 3.15.2 due t…Check if you run itEPSS 0.34%May 21, 2026
- Medium4.9The WPB Floating Menu & Categories for WordPress – Sticky Side Menu with Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Icon CSS Clas…Check if you run itEPSS 0.31%May 21, 2026
- Critical10.0A missing authentication vulnerability exists in the Altium 365 SearchService.Check if you run itEPSS 0.34%May 21, 2026
- Medium4.3The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX act…Check if you run itEPSS 0.22%May 21, 2026
- Medium6.5A flaw was found in libsolv.Check if you run itEPSS 0.31%May 21, 2026
- High8.7authentik is an open-source identity provider.Check if you run itEPSS 0.50%May 21, 2026
- Medium6.7Trend Micro Apex One (On-Premise) Directory Traversal VulnerabilityPatch nowKEVEPSS 13.42%May 21, 2026
- Medium6.5A flaw was found in libsolv.Check if you run itEPSS 0.41%May 20, 2026
Sort