Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8Integer truncation in Valkey cluster publish message construction causes a heap buffer overflowOpen the advisoryOct 26, 2026
- Medium6.5DoS in zstd decompressionOpen the advisoryOct 22, 2026
- HighForwardAuth shares the auth-server connection pool, leaking NTLM/Negotiate-bound identity across clientsOpen the advisoryOct 21, 2026
- Highingress-nginx provider: mTLS (auth-tls-secret) silently disabled for a host when another Ingress on the same host has no matching auth-tls annotationOpen the advisoryOct 16, 2026
- LowCaddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak throughOpen the advisoryOct 13, 2026
- HighKubernetes Ingress NGINX provider: ssl-passthrough sibling HTTP router serves the auth-protected backend without authOpen the advisoryOct 7, 2026
- Highsnicheck skips the check when is nil (HTTP/2 )Open the advisoryOct 7, 2026
- Medium6.5Caddy is an extensible server platform that uses TLS by default.Check if you run itEPSS 0.49%Sep 17, 2026
- High8.8Unauthenticated use-after-free of the Lua interpreter state in Valkey (script debugger command cache)Open the advisoryAug 31, 2026
- High7.5Use-after-free in the RDMA pending-data handler when a clientOpen the advisoryAug 31, 2026
- Medium4.3Improper access control on the back-office notifications endpoint exposes customer dataOpen the advisoryAug 18, 2026
- Medium6.5SQL injection through back-office list filtersOpen the advisoryAug 18, 2026
- High7.3Client IP address can be spoofed through the X-Forwarded-For headerOpen the advisoryAug 18, 2026
- High8.0Formula injection in CSV exports (CSV injection)Open the advisoryAug 18, 2026
- High8.2Server-Side Request Forgery through image URLs in the CSV importOpen the advisoryAug 18, 2026
- High8.8Valkey is a distributed key-value database.Check if you run itEPSS 0.89%Jul 22, 2026
- High7.5Valkey is a distributed key-value database.Check if you run itEPSS 0.52%Jul 22, 2026
- MediumConnection created for the wrong upstream for forward_auth + reverse_proxyOpen the advisoryJul 10, 2026
- High8.1Caddy is an extensible server platform that uses TLS by default.Check if you run itEPSS 0.45%Jun 8, 2026
- High7.5Windows path authorization bypass via encoded backslashCheck if you run itEPSS 0.62%Jun 8, 2026
- Medium4.2Caddy is an extensible server platform that uses TLS by default.Check if you run itEPSS 0.25%Jun 8, 2026
- Medium5.1Prometheus is an open-source monitoring system and time series database.Check if you run itEPSS 0.20%May 26, 2026
- Medium4.3Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path MatchingOpen the advisoryMay 13, 2026
- Medium5.4Caddy is an extensible server platform that uses TLS by default.Check if you run itEPSS 0.24%May 13, 2026
- HighGHSA-wwhq-w58m-w29c is listed by Caddy CVE-2026-30852 Fix Bypass.Open the advisoryMay 13, 2026
Sort