Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.1When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin…Check if you run itEPSS 0.60%May 22, 2026
- Critical9.1The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it.Check if you run itEPSS 0.47%May 22, 2026
- Critical9.1When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request.Check if you run itEPSS 0.68%May 22, 2026
- Critical9.1The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag.Check if you run itEPSS 0.48%May 22, 2026
- Critical9.1A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.Check if you run itEPSS 0.68%May 22, 2026
- High7.5The RSA and DSA public key parsers did not enforce size limits on key parameters.Check if you run itEPSS 0.47%May 22, 2026
- Medium6.3When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certi…Check if you run itEPSS 0.37%May 22, 2026
- Medium6.5An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process an…Check if you run itEPSS 0.28%May 22, 2026
- Critical9.6The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.Check if you run itEPSS 1.83%May 22, 2026
- Critical9.3A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciously c…Check if you run itEPSS 0.23%May 22, 2026
- High7.7A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlyin…Check if you run itEPSS 0.68%May 22, 2026
- Critical9.1A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.Check if you run itEPSS 1.25%May 22, 2026
- Unknownxiongmaitech uc-httpd Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 28.27%May 22, 2026
- Medium6.5Kludex Starlette HTTP Request/Response Smuggling VulnerabilityPatch nowKEVEPSS 70.29%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion().Check if you run itEPSS 0.11%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple().Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan().Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star().Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file removeFavoriteFolder($id).Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file addFavoriteFolder($id).Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/express/association/reorder.Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/event/duplicate.Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/design.Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/cache.Check if you run itEPSS 0.13%May 21, 2026
- Low2.3Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/dialog/page/bulk/delete.Check if you run itEPSS 0.13%May 21, 2026
Sort