Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with the top b…Check if you run itEPSS 0.34%Oct 2, 2026
- UnknownGitLab AI Gateway Critical Patch Release: 19.2.4, 19.3.2, and 19.4.1Check if you run itEPSS 0.94%Oct 2, 2026
- UnknownUnrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 0.59%Oct 2, 2026
- UnknownServer-Side Request Forgery (SSRF)Patch nowKEVEPSS 0.36%Oct 2, 2026
- UnknownImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 0.53%Oct 2, 2026
- High7.6Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by sup…Check if you run itEPSS 0.29%Oct 1, 2026
- High8.4Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier allows an…Check if you run itEPSS 0.13%Oct 1, 2026
- High7.5A NULL pointer dereference in mod_xml2enc in Apache Software Foundation Apache HTTP Server before 2.4.69 on all platforms allows an untrusted backend server to cause a denial of seCheck if you run itEPSS 0.48%Oct 1, 2026
- High7.5Stack-based buffer overflow in mod_vhost_alias in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platforms allows a remote client to cause a denial of serviceCheck if you run itEPSS 0.88%Oct 1, 2026
- Medium5.4OpenStack Swift vulnerable to authenticated server-side request forgeryOpen the advisoryOct 1, 2026
- UnknownView CSAF Summary Successful exploitation of this vulnerability could allow an attacker to gain access to sensitive information that could be used to conduct further a…Check if you run itEPSS 0.24%Oct 1, 2026
- MediumRabbitMQ OAuth credential refresh retains revoked runtime tagsCheck if you run itEPSS 0.23%Oct 1, 2026
- MediumRabbitMQ: Federation and Shovel Gen-Servers Lack format_status Callback — Plaintext Credentials Exposed in Crash Dumps and sys:get_statusCheck if you run itEPSS 0.29%Oct 1, 2026
- MediumRabbitMQ: OAuth2 is_integer(Exp) guard skips token-expiry checks for float expCheck if you run itEPSS 0.34%Oct 1, 2026
- MediumRabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission checkCheck if you run itEPSS 0.34%Oct 1, 2026
- HighRabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UICheck if you run itEPSS 0.16%Oct 1, 2026
- Medium6.1A flaw was found in oauth-proxy.Check if you run itEPSS 0.25%Oct 1, 2026
- High8.8ZDI-26-751: Microsoft Windows dxgkrnl Time-Of-Check Time-Of-Use Local Privilege Escalation VulnerabilityCheck if you run itEPSS 0.29%Oct 1, 2026
- Critical9.8Fortinet FortiMail Path Traversal VulnerabilityPatch nowKEVEPSS 2.20%Oct 1, 2026
- UnknownImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 0.81%Oct 1, 2026
- Medium6.1An attacker could cause a heap buffer overflow by getting a user to open an email that is greater than or equal to 2GB in size.Check if you run itEPSS 0.21%Sep 30, 2026
- High7.5league/commonmark: Quadratic-time denial of service in the GitHub Flavored Markdown Table extension block-start scanCheck if you run itEPSS 0.37%Sep 30, 2026
- Low2.1[SECURITY] [DSA 6550-1] ghostscript security updateCheck if you run itEPSS 0.52%Sep 30, 2026
- UnknownA vulnerability was determined in Blosc C-Blosc2 up to 3.3.2.Check if you run itEPSS 0.28%Sep 30, 2026
- High7.6PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data.Open the advisorySep 30, 2026