Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.5IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by an information disclosure vulnerability that allows an authenticated attacker to ob…Check if you run itEPSS 0.29%Oct 13, 2026
- Medium4.3IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a Reader-role attacker to obtain version information that causes an uncaught exception.Check if you run itEPSS 0.21%Oct 13, 2026
- Medium5.4IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 is affected by a privilege escalation vulnerability with the restConnector-2.0 feature enabled.Check if you run itEPSS 0.18%Oct 13, 2026
- UnknownImageMagick before 7.1.2-33 and 6.9.13-58 contains a heap buffer underwrite vulnerability in DecodeImage() in coders/pict.c on 32-bit builds due to pointer arithmetic overflow.Check if you run itEPSS 0.36%Oct 13, 2026
- Medium5.3Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by…Check if you run itEPSS 0.20%Oct 13, 2026
- Low3.5Indico is a feature-rich event management system.Check if you run itEPSS 0.26%Oct 13, 2026
- High7.0NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths.Check if you run itEPSS 0.32%Oct 13, 2026
- Medium6.0FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential dele…Check if you run itEPSS 0.22%Oct 13, 2026
- Medium6.0The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiat…Check if you run itEPSS 0.26%Oct 13, 2026
- Medium6.9FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows ma…Check if you run itEPSS 0.30%Oct 13, 2026
- Medium5.3FreeRDP from 3.0.0 before 3.32.0 contains a heap out-of-bounds read vulnerability that allows a malicious RD Gateway to crash clients by sending mismatched message lengths.Check if you run itEPSS 0.28%Oct 13, 2026
- Medium5.3FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory.Check if you run itEPSS 0.24%Oct 13, 2026
- High7.1FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized d…Check if you run itEPSS 0.27%Oct 13, 2026
- High7.1FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client.Check if you run itEPSS 0.27%Oct 13, 2026
- Medium6.0FreeRDP 3.0.0 before 3.32.0 contains a heap use-after-free vulnerability in smartcard emulation when SCARD_IOCTL_DISCONNECT and SCARD_IOCTL_TRANSMIT operate concurrent…Check if you run itEPSS 0.23%Oct 13, 2026
- High7.1FreeRDP 3.29.0 before 3.32.0 contains a double free in the client's async-update message proxy, which shallow-copies the parser-owned PolygonSC or PolygonCB points arr…Check if you run itEPSS 0.27%Oct 13, 2026
- Medium5.4When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the request…Check if you run itEPSS 0.21%Oct 13, 2026
- High7.1FreeRDP 2.3.0 before 3.32.0 dereferences a NULL stream in rdg_process_close_packet in libfreerdp/core/gateway/rdg.c because rdg_process_control_packet accepts a header…Check if you run itEPSS 0.27%Oct 13, 2026
- Medium5.3When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request…Check if you run itEPSS 0.28%Oct 13, 2026
- Medium6.1The auth0/nextjs-auth0 SDK validates that the returnTo parameter is a same-origin URL.Check if you run itEPSS 0.22%Oct 13, 2026
- High7.1FreeRDP from 2.3.0 before 3.32.0 contains an infinite loop vulnerability in http_chuncked_read that allows malicious RD Gateways to hang clients by sending incomplete…Check if you run itEPSS 0.27%Oct 13, 2026
- Medium5.1FreeRDP 3.0.0-beta1 before 3.32.0 on Unix builds with PKCS#11 support has a stack-based buffer overflow in wprintKeyName() in WinPR's NCrypt PKCS#11 provider.Check if you run itEPSS 0.15%Oct 13, 2026
- UnknownCVE-2026-109939Check if you run itEPSS 0.27%Oct 13, 2026
- Critical10.0ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of th…Check if you run itEPSS 1.05%Oct 13, 2026
- High7.1Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with…Check if you run itEPSS 0.27%Oct 13, 2026