Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical10.0iCagenda Unrestricted Upload of File with Dangerous Type VulnerabilityPatch nowKEVEPSS 20.07%Jun 20, 2026
- Highgithubtoplanguages: Command Injection via Issue Title in Discord Notification WorkflowCheck if you run itEPSS 0.53%Jun 19, 2026
- HighUni-CLI: Legacy HTTP MCP transport accepted browser-originated localhost requestsCheck if you run itEPSS 0.26%Jun 19, 2026
- High7.1libde265 is an open source implementation of the h.265 video codec.Check if you run itEPSS 0.37%Jun 19, 2026
- UnknownCVE-2026-9375Open the advisoryJun 19, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: bpf: Free reuseport cBPF prog after RCU grace period.Check if you run itEPSS 0.14%Jun 19, 2026
- High7.8In the Linux kernel, the following vulnerability has been resolved: ip6_vti: set netns_immutable on the fallback device.Check if you run itEPSS 0.11%Jun 19, 2026
- UnknownJupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocolCheck if you run itEPSS 0.30%Jun 19, 2026
- UnknownEntire CLI: Path traversal in checkpoint session metadata allows arbitrary file write during resume/rewindCheck if you run itEPSS 0.38%Jun 19, 2026
- UnknownImproper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')Patch nowKEVEPSS 0.94%Jun 19, 2026
- High7.1MapPress Maps for WordPress Cross-Site Scripting (XSS)Patch nowKEVEPSS 0.25%Jun 19, 2026
- Medium6.5libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a malicious SSH server oCheck if you run itEPSS 0.65%Jun 18, 2026
- Critical9.3JTL Shop versions 5.2.0 through 5.7.1 contains a server-side template injection vulnerability that allows unauthenticated attackers to inject malicious template syntax…Check if you run itEPSS 0.60%Jun 18, 2026
- Critical9.6NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing.Check if you run itEPSS 0.43%Jun 18, 2026
- Critical9.1HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allows buffer misparse as new FCGI record heaCheck if you run itEPSS 0.33%Jun 18, 2026
- High7.8A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled envirCheck if you run itEPSS 0.16%Jun 18, 2026
- Unknowntheme-fusion avada_builder Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 3.01%Jun 18, 2026
- High8.8Tinyproxy through 1.11.3, fixed in commit 09312a1, fails to properly validate the Host header during stathost detection, allowing unauthenticated attackers to access t…Check if you run itEPSS 0.38%Jun 17, 2026
- Critical9.2libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that fails to enforce upper bounds on packet_length field.Check if you run itEPSS 3.88%Jun 17, 2026
- UnknownDrupal core - Moderately critical - Improper validation - SA-CORE-2026-009Check if you run itEPSS 0.27%Jun 17, 2026
- UnknownDrupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008Check if you run itEPSS 0.22%Jun 17, 2026
- UnknownDrupal core - Less critical - Cache poisoning and open redirect - SA-CORE-2026-007Check if you run itEPSS 0.34%Jun 17, 2026
- UnknownDrupal core - Moderately critical - Gadget chain - SA-CORE-2026-006Check if you run itEPSS 0.35%Jun 17, 2026
- UnknownDrupal core - Critical - PHP object injection - SA-CORE-2026-005Check if you run itEPSS 0.35%Jun 17, 2026
- Critical9.3PTC Windchill and FlexPLM Improper Input Validation VulnerabilityPatch nowKEVEPSS 46.05%Jun 17, 2026
Sort