Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.8The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses.EPSS 0.1%Oct 15, 2026
- Critical9.4Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote actor with standard database…EPSS 0.4%Oct 15, 2026
- High7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects…EPSS 0.1%Oct 15, 2026
- Medium5.9In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped provider ID, but falls back…EPSS 0.1%Oct 15, 2026
- Medium6.7In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possibleEPSS 0.2%Oct 15, 2026
- High8.0In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possibleEPSS 0.2%Oct 15, 2026
- High8.1In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possibleEPSS 0.4%Oct 15, 2026
- High7.5In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary filesEPSS 0.4%Oct 15, 2026
- Medium6.5In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commandsEPSS 0.3%Oct 15, 2026
- High7.8In JetBrains Junie CLI before 26.8.3 code execution was possible via an untrusted project's MCP server configurationEPSS 0.1%Oct 15, 2026
- Critical9.3A vulnerability was found in Wavlink WN530HG4B M30HG4B_V260724.EPSS 1.1%Oct 15, 2026
- High8.7In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser of the ExpressionLanguage component built its node tree with no bound on its depth.EPSS 0.5%Oct 15, 2026
- Critical9.4A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.EPSS 0.5%Oct 15, 2026
- High8.2kin-openapi is a Go project for handling OpenAPI files.EPSS 0.4%Oct 15, 2026
- Critical9.3A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604.EPSS 3.5%Oct 15, 2026
- High8.4A vulnerability has been identified in Siemens Software Center (All versions).EPSS 0.1%Oct 15, 2026
- High7.8A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse t…EPSS 0.2%Oct 15, 2026
- High8.7In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for…EPSS 0.5%Oct 15, 2026
- High7.5In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup…EPSS 0.2%Oct 15, 2026
- High8.7Symfony is a PHP framework for web and console applications and a set of reusable PHP components.EPSS 0.4%Oct 15, 2026
- Medium5.4In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without prope…EPSS 0.2%Oct 15, 2026
- Medium5.4In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and…EPSS 0.2%Oct 15, 2026
- Medium5.4In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with ver…EPSS 0.2%Oct 15, 2026
- Medium5.4In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without pro…EPSS 0.2%Oct 15, 2026
- UnknownAUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.EPSS 0.8%Oct 15, 2026