Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.2FreeRDP before 3.32.0 fails to close prior serial handles in serial_process_irp_create, allowing a malicious RDP server to exhaust file descriptors.EPSS 0.3%Oct 14, 2026
- High7.1FreeRDP versions from 3.0.0 before 3.32.0 contain a null pointer dereference in the rdpsnd channel when a fragment sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST.EPSS 0.3%Oct 14, 2026
- Low2.1A weakness has been identified in sgl-project SGLang up to 0.5.19.EPSS 0.3%Oct 14, 2026
- High7.5Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perf…EPSS 0.2%Oct 14, 2026
- UnknownCVE-2026-106485Oct 14, 2026
- UnknownCVE-2026-106068Oct 14, 2026
- UnknownCVE-2026-106006Oct 14, 2026
- UnknownCVE-2026-105627Oct 14, 2026
- High7.1Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id FieldEPSS 0.2%Oct 14, 2026
- High8.2Nodemailer 3.0.0 before 10.0.10 Denial of Service via SMTP Reply ParsingEPSS 0.3%Oct 14, 2026
- High7.1Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding.EPSS 0.3%Oct 14, 2026
- Medium6.9Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses.EPSS 0.2%Oct 14, 2026
- High8.7Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection RegexesEPSS 0.3%Oct 14, 2026
- High8.4Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasourcesEPSS 0.2%Oct 14, 2026
- Critical9.0Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset.EPSS 0.2%Oct 14, 2026
- Medium5.3Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase RequestEPSS 0.2%Oct 14, 2026
- High7.1Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared PresetsEPSS 0.2%Oct 14, 2026
- Critical9.1Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth ProxyEPSS 0.3%Oct 14, 2026
- High8.6Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO ProvidersEPSS 0.3%Oct 14, 2026
- Critical9.3Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic LinkEPSS 0.3%Oct 14, 2026
- Medium6.3Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race ConditionEPSS 0.2%Oct 14, 2026
- Medium6.9GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()EPSS 0.1%Oct 14, 2026
- High8.7GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch NameEPSS 0.3%Oct 14, 2026
- Critical9.2GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() RefspecEPSS 0.5%Oct 14, 2026
- High7.7GitPython before 3.2.0 Command Execution via ls_remote ext:: URLsEPSS 0.4%Oct 14, 2026