Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Wicket.Check if you run itEPSS 0.62%May 6, 2026
- Medium6.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket.Check if you run itEPSS 0.57%May 6, 2026
- Critical9.1Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket.Check if you run itEPSS 0.61%May 6, 2026
- High8.2OpenMRS Core is an open source electronic medical record system platform.Check if you run itEPSS 0.72%May 5, 2026
- Critical9.8Heap-based Buffer Overflow vulnerability in mod_proxy_ajp of Apache HTTP Server.Check if you run itEPSS 1.63%May 5, 2026
- High8.2ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx.Check if you run itEPSS 0.52%May 5, 2026
- High7.3Allocation of Resources Without Limits or Throttling vulnerability in Apache HTTP Server's mod_md via OCSP response data.Check if you run itEPSS 1.07%May 5, 2026
- High7.3Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of CRLF Sequences in HTTP Headers ('HT…Check if you run itEPSS 0.38%May 5, 2026
- Medium5.3Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.Check if you run itEPSS 1.20%May 5, 2026
- High7.3Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.Check if you run itEPSS 0.81%May 5, 2026
- Critical9.4In Apache Iceberg, the table's metadata files are control files: they tell readers which data files belong to the table and which table version to read.Check if you run itEPSS 0.59%May 4, 2026
- Critical9.4In plain terms, Apache Polaris is supposed to issue short-lived GCS credentials that only work for one table's files, but a crafted namespace or table name can cause t…Check if you run itEPSS 0.72%May 4, 2026
- Critical9.4Apache Polaris accepts literal characters in namespace and table names.Check if you run itEPSS 0.69%May 4, 2026
- Critical9.4Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or durably reserved.Check if you run itEPSS 0.58%May 4, 2026
- High7.5OOM Denial of Service via Unbounded Array Allocation in Apache OpenNLP AbstractModelReader Versions Affected: before 1.9.5 before 2.5.9 before 3.0.0-M3 Description: Th…Check if you run itEPSS 1.06%May 4, 2026
- Critical9.8Arbitrary Class Instantiation via Model Manifest in Apache OpenNLP ExtensionLoader Versions Affected: before 1.9.5, before 2.5.9, before 3.0.0-M3 Description: The Exte…Check if you run itEPSS 1.27%May 4, 2026
- Critical9.1XML External Entity (XXE) via Unsanitized Dictionary Parsing in Apache OpenNLP DictionaryEntryPersistor Versions Affected: before 2.5.9, before 3.0.0-M3 Description: T…Check if you run itEPSS 0.84%May 4, 2026
- High8.1Description: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Atlas Apache Atlas exposes a DSL search endpoint that accepts user-suppl…Check if you run itEPSS 0.60%May 4, 2026
- Medium6.5HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers.Check if you run itEPSS 0.44%May 4, 2026
- Medium5.3A NULL pointer dereference in the mod_authn_socache in Apache HTTP Server 2.4.66 and earlier allows an unauthenticated remote user to crash a child process in a cachin…Check if you run itEPSS 1.20%May 4, 2026
- Medium4.8A timing attack against mod_auth_digest in Apache HTTP Server 2.4.66 allows a bypass of Digest authentication by a remote attacker.Check if you run itEPSS 0.56%May 4, 2026
- High7.5A NULL pointer dereference in mod_dav_lock in Apache HTTP Server 2.4.66 and earlier may allow an attacker to crash the server with a malicious request.mod_dav_lock is…Check if you run itEPSS 1.57%May 4, 2026
- High8.8Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.Check this weekEPSS 49.73%May 4, 2026
- Medium5.3Improper Null Termination, Out-of-bounds Read vulnerability in Apache HTTP Server.Check if you run itEPSS 0.94%May 4, 2026
- Medium5.3Out-of-bounds Read vulnerability in mod_proxy_ajp of Apache HTTP Server.Check if you run itEPSS 0.94%May 4, 2026