Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium4.4Indico: Cross-Site-Scripting in minutes editorCheck if you run itEPSS 0.23%Oct 8, 2026
- High7.1PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypassCheck if you run itEPSS 0.46%Oct 8, 2026
- Critical9.3Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-admin JobInfoController endpo…Check if you run itEPSS 0.54%Oct 8, 2026
- Medium5.9The MongoDB Python Driver's binary accelerator can read outside a buffer when an application decodes malformed BSON containing a truncated regular-expression element w…Check if you run itEPSS 0.09%Oct 8, 2026
- High8.3Poppler 0.42.0 through 26.10.0 contains a stack-based buffer overflow in Decrypt::revision6Hash() that allows attackers controlling the password to overwrite stack mem…Check if you run itEPSS 0.33%Oct 8, 2026
- High7.5music-metadata is a metadata parser for audio and video media files.Check if you run itEPSS 0.29%Oct 8, 2026
- Medium5.5music-metadata is a metadata parser for audio and video media files.Open the advisoryOct 8, 2026
- High8.1MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)Check if you run itEPSS 0.45%Oct 8, 2026
- Medium5.9MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLSCheck if you run itEPSS 0.24%Oct 8, 2026
- HighCairoSVG: Quadratic-time DoS parsing a crafted SVGCheck if you run itEPSS 0.38%Oct 8, 2026
- High8.8dot-access through 1.0.0 contains a prototype pollution vulnerability that allows attackers to modify Object.prototype by supplying a crafted dotted path to set().Check if you run itEPSS 0.33%Oct 8, 2026
- Medium5.3FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redire…Check if you run itEPSS 0.26%Oct 8, 2026
- Medium5.3FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions when openin…Check if you run itEPSS 0.32%Oct 8, 2026
- High7.1FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit.Check if you run itEPSS 0.35%Oct 8, 2026
- High7.1FFmpeg before 8.1.3 contains an infinite loop vulnerability in the HLS demuxer that allows remote attackers to cause denial of service because parse_playlist() accepts…Check if you run itEPSS 0.46%Oct 8, 2026
- Medium6.9Coraza: URL-encoded form Content-Type parameters bypass Coraza body inspection in github.com/corazawaf/corazaOpen the advisoryOct 8, 2026
- Medium4.0Coraza: Multipart filename* (RFC 5987) charset restriction lets a decoy filename bypass FILES-based rules in github.com/corazawaf/corazaOpen the advisoryOct 8, 2026
- Medium5.8Coraza body processor has a JSON key collision that allows unauthenticated attackers to bypass OWASP CRS inspectionOpen the advisoryOct 8, 2026
- UnknownPraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDLCheck if you run itEPSS 0.70%Oct 8, 2026
- LowPydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted whenCheck if you run itEPSS 0.30%Oct 8, 2026
- Medium6.8AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)Check if you run itEPSS 0.30%Oct 8, 2026
- Medium6.8AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSCheck if you run itEPSS 0.36%Oct 8, 2026
- High7.5AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabledCheck if you run itEPSS 0.43%Oct 8, 2026
- High7.4AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsCheck if you run itEPSS 0.19%Oct 8, 2026
- Low3.7AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random sourceCheck if you run itEPSS 0.26%Oct 8, 2026