Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.5ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service.Check if you run itEPSS 0.86%Oct 13, 2026
- High8.4ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user.Check if you run itEPSS 0.33%Oct 13, 2026
- Critical9.6ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.Check if you run itEPSS 0.33%Oct 13, 2026
- High7.6ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.Check if you run itEPSS 0.59%Oct 13, 2026
- High8.4ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user.Check if you run itEPSS 0.40%Oct 13, 2026
- Medium6.7Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally.Check if you run itEPSS 0.26%Oct 13, 2026
- Medium6.9Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via un…Check if you run itEPSS 0.34%Oct 13, 2026
- Medium6.9Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_attempts by sending concurrent requests.Check if you run itEPSS 0.25%Oct 13, 2026
- High8.5Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.39%Oct 13, 2026
- Medium4.9Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.Check if you run itEPSS 0.54%Oct 13, 2026
- Medium6.5Uncontrolled resource consumption in SQL Server allows an authorized attacker to deny service over a network.Check if you run itEPSS 0.59%Oct 13, 2026
- High8.5Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.Check if you run itEPSS 0.39%Oct 13, 2026
- High7.1Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve the plaintext authd.pass e…Check if you run itEPSS 0.26%Oct 13, 2026
- High7.1Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR.Check if you run itEPSS 0.34%Oct 13, 2026
- High8.8Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.Check if you run itEPSS 0.88%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submittin…Check if you run itEPSS 0.22%Oct 13, 2026
- Medium5.3Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-contro…Check if you run itEPSS 0.29%Oct 13, 2026
- Critical9.4Wazuh 4.14.3 before 4.14.8 contains a case-sensitivity mismatch between the ossec.conf validator and wazuh-logcollector that bypasses remote-command validation.Check if you run itEPSS 0.37%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by subm…Check if you run itEPSS 0.28%Oct 13, 2026
- Critical9.4Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overw…Check if you run itEPSS 0.55%Oct 13, 2026
- High8.6Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist.Check if you run itEPSS 0.39%Oct 13, 2026
- High8.6Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source.Check if you run itEPSS 0.83%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting a…Check if you run itEPSS 0.22%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attribute…Check if you run itEPSS 0.30%Oct 13, 2026
- High8.7Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path.Check if you run itEPSS 0.34%Oct 13, 2026