Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownPraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDLCheck if you run itEPSS 0.70%Oct 8, 2026
- LowPydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted whenCheck if you run itEPSS 0.30%Oct 8, 2026
- Medium6.8AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)Check if you run itEPSS 0.30%Oct 8, 2026
- Medium6.8AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSCheck if you run itEPSS 0.36%Oct 8, 2026
- High7.5AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabledCheck if you run itEPSS 0.43%Oct 8, 2026
- High7.4AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsCheck if you run itEPSS 0.19%Oct 8, 2026
- Low3.7AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random sourceCheck if you run itEPSS 0.26%Oct 8, 2026
- UnknownAsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukCheck if you run itEPSS 0.26%Oct 8, 2026
- CriticalAsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostCheck if you run itEPSS 0.19%Oct 8, 2026
- Medium5.7FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in av_encryption_init_info_free() in libavutil/encryption_info.c, which recursively frees AVEncryptionIn…Check if you run itEPSS 0.09%Oct 8, 2026
- Medium5.7FFmpeg through 9.0.2 contains a denial of service vulnerability in the DASH demuxer that allows attackers to trigger an infinite loop by supplying an empty SegmentTemp…Check if you run itEPSS 0.14%Oct 8, 2026
- Medium4.8FFmpeg through 9.0.2 contains an uninitialized memory disclosure vulnerability in av_dynamic_hdr_plus_to_t35() that leaves up to three payload bytes uninitialized when…Check if you run itEPSS 0.14%Oct 8, 2026
- Medium6.0FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the libssh-based sftp protocol handler that allows network attackers to impersonate SFTP servers.Check if you run itEPSS 0.19%Oct 8, 2026
- Medium6.3FFmpeg before 8.1.3 and 9.x before 9.0.2 contains an improper certificate validation vulnerability in tls_open() of libavformat/tls_mbedtls.c, which skips hostname che…Check if you run itEPSS 0.14%Oct 8, 2026
- Critical9.1IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cau…Check if you run itEPSS 0.27%Oct 8, 2026
- Critical9.8IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obt…Check if you run itEPSS 0.39%Oct 8, 2026
- Medium6.5IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obta…Check if you run itEPSS 0.09%Oct 8, 2026
- Medium6.9Dislocker through 0.7.3 contains an integer underflow vulnerability in get_vmk() and get_fvek() that allows attackers to trigger out-of-bounds heap reads via crafted datum sizes.Check if you run itEPSS 0.13%Oct 8, 2026
- High8.6IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obt…Check if you run itEPSS 0.27%Oct 8, 2026
- Medium6.3Parse Server 9.0.0 before 9.10.1 Class Name Disclosure via GraphQL ErrorsCheck if you run itEPSS 0.33%Oct 8, 2026
- Medium5.3IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated a…Check if you run itEPSS 0.31%Oct 8, 2026
- Medium5.3An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details…Check if you run itEPSS 0.15%Oct 8, 2026
- High7.6An unauthenticated remote attacker can modify the TLS client trust store in Brocade ASCG versions before 3.5.0.Check if you run itEPSS 0.10%Oct 8, 2026
- High7.7When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences…Check if you run itEPSS 0.31%Oct 8, 2026
- High7.0Brocade ASCG before 3.5.0 has a well-known Brocade default password embedded in a script distributed to every customer.Check if you run itEPSS 0.09%Oct 8, 2026