Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.6Open WebUI 0.6.27 before 0.11.4 Session Token Disclosure via OAuth-Mode ConnectionsCheck if you run itEPSS 0.32%Oct 12, 2026
- Medium5.4Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions.Check if you run itEPSS 0.39%Oct 12, 2026
- Medium6.5In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting…Check if you run itEPSS 0.24%Oct 12, 2026
- Unknownhex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25Check if you run itEPSS 0.24%Oct 12, 2026
- High7.5A SQL Injection (SQLi) affects the Kong Gateway (Enterprise and Open Source) clustering communication logic when operating in Hybrid Mode.Check if you run itEPSS 0.13%Oct 12, 2026
- High8.7A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory.Check if you run itEPSS 0.72%Oct 12, 2026
- High8.8The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22).Check if you run itEPSS 0.41%Oct 12, 2026
- Low3.6ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations where nginx and a served application (e.g., WordPress) run under the sa…Check if you run itEPSS 0.12%Oct 12, 2026
- UnknownImportant: kernel security updateOpen the advisoryOct 12, 2026
- Medium5.3Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs.Check if you run itEPSS 0.28%Oct 11, 2026
- Medium6.9Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the…Check if you run itEPSS 0.32%Oct 11, 2026
- UnknownMalicious code in staking-apr-fetcher (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in tron-trc20-utils (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in hd-wallet-generator (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in wallet-balance-scanner (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in ton-jetton-tools (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in wallet-hd-derive (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in perp-funding-rates (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in sol-mint-utils (RubyGems)Open the advisoryOct 11, 2026
- High7.7OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions.Open the advisoryOct 10, 2026
- UnknownMalicious code in agentaix (PyPI)Open the advisoryOct 10, 2026
- High7.2Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set.Open the advisoryOct 9, 2026
- High7.1Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to keep receiving project data through webhooks they created.Open the advisoryOct 9, 2026
- Medium5.3Contao: The registration module re-sends activation mailsCheck if you run itEPSS 0.26%Oct 9, 2026
- High8.8Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URLCheck if you run itEPSS 1.55%Oct 9, 2026