Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownD-Link dap-1650_firmware Improper Neutralization of Special Elements used in a Command ('Command Injection')Patch nowKEVEPSS 7.29%Oct 5, 2026
- Low1.8ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in LoadPolicyCache that silently skips security policy rules when policy.xml uses an a…Check if you run itEPSS 0.11%Oct 3, 2026
- UnknownRejetto hfs2 Improper Neutralization of Special Elements Used in a Template EnginePatch nowKEVEPSS 0.78%Oct 3, 2026
- Medium5.5Trigger.dev: Trigger CLI debug deployment logs expose resolved environment secret valuesOpen the advisoryOct 2, 2026
- Critical10.0Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chainOpen the advisoryOct 2, 2026
- High7.5Vibe-Trading file-read tools expose arbitrary server-readable filesOpen the advisoryOct 2, 2026
- Critical10.0Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRFOpen the advisoryOct 2, 2026
- High7.7Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function nameOpen the advisoryOct 2, 2026
- Medium5.3Trigger.dev: Unauthenticated Realtime Stream Data Injection via Run FriendlyIdOpen the advisoryOct 2, 2026
- Critical9.2Trigger.dev Self-Hosted Deployment: Default Secrets allow Unauthenticated Infrastructure CompromiseCheck this weekEPSS 35.00%Oct 2, 2026
- HighXray-core: Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacksOpen the advisoryOct 2, 2026
- Medium5.4Trigger.dev: Blind SSRF via alert-channel webhookOpen the advisoryOct 2, 2026
- High7.1Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)Open the advisoryOct 2, 2026
- UnknownCVE-2026-104019 - OS command injection in the Studio Space startup script in Amazon SageMaker DistributionCheck if you run itEPSS 1.42%Oct 2, 2026
- High8.8Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree PathsOpen the advisoryOct 2, 2026
- High7.1Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object ResolutionOpen the advisoryOct 2, 2026
- High8.6Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protectionsOpen the advisoryOct 2, 2026
- High8.6Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinksOpen the advisoryOct 2, 2026
- UnknownCVE-2026-103505 - Mount Option Injection in Amazon EFS CSI DriverCheck if you run itEPSS 0.43%Oct 2, 2026
- High8.7In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with the top b…Check if you run itEPSS 0.34%Oct 2, 2026
- UnknownGitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1Check if you run itEPSS 0.94%Oct 2, 2026
- UnknownUnrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.59%Oct 2, 2026
- UnknownServer-Side Request Forgery (SSRF)Patch nowKEVEPSS 0.36%Oct 2, 2026
- UnknownImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 0.53%Oct 2, 2026
- High7.6Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by sup…Check if you run itEPSS 0.29%Oct 1, 2026