Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.8libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent…EPSS 0.1%Oct 15, 2026
- Medium6.9libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS.EPSS 0.1%Oct 15, 2026
- Medium6.9libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash.EPSS 0.1%Oct 15, 2026
- High8.8Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.EPSS 0.2%Oct 15, 2026
- Medium6.9MP4v2 through 2.1.3 contains a heap-based out-of-bounds read in MP4File::GetChapters() that allows attackers to read past heap allocations via crafted QuickTime chapter samples.EPSS 0.1%Oct 15, 2026
- Medium6.5Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a…EPSS 0.2%Oct 15, 2026
- High8.8Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.EPSS 0.3%Oct 15, 2026
- High8.8Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.EPSS 0.3%Oct 15, 2026
- High8.8Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.EPSS 0.2%Oct 15, 2026
- High8.8Memory corruption in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.EPSS 0.2%Oct 15, 2026
- High8.8Memory corruption in Core in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page.EPSS 0.2%Oct 15, 2026
- High8.8Memory corruption in SVG in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to read memory via a crafted HTML page.EPSS 0.2%Oct 15, 2026
- High8.8Use after free in V8 in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.EPSS 0.2%Oct 15, 2026
- High8.8Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.EPSS 0.3%Oct 15, 2026
- High7.1ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete RoutesEPSS 0.2%Oct 15, 2026
- Medium6.1ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete RoutesEPSS 0.2%Oct 15, 2026
- Medium6.9BillionMail through 4.9 Forgeable JWTs via Default Signing KeyEPSS 0.3%Oct 15, 2026
- High8.6cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user EndpointsEPSS 0.4%Oct 15, 2026
- High7.0cool-admin-midway through 8.0.0 Missing Authorization via System Role EndpointsEPSS 0.3%Oct 15, 2026
- High7.1MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET BranchEPSS 0.2%Oct 15, 2026
- High8.8The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment).EPSS 0.3%Oct 15, 2026
- Critical9.6EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.EPSS 0.3%Oct 15, 2026
- Critical9.8The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication.EPSS 0.6%Oct 15, 2026
- Critical9.9EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supply…EPSS 0.4%Oct 15, 2026
- High7.5EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over…EPSS 0.2%Oct 15, 2026