Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by…Check if you run itEPSS 0.20%Oct 13, 2026
- Low3.5Indico is a feature-rich event management system.Check if you run itEPSS 0.26%Oct 13, 2026
- Medium6.9FreeRDP 3.17.1 before 3.32.0 contains a heap buffer over-read vulnerability in DynvcTrackerHandleCreateBack of the freerdp-proxy DRDYNVC channel handler that allows ma…Check if you run itEPSS 0.30%Oct 13, 2026
- Medium5.3FreeRDP from 3.0.0 before 3.32.0 contains an uninitialized memory disclosure vulnerability in smartcard_Transmit_Call that allows malicious RDP servers to read client memory.Check if you run itEPSS 0.24%Oct 13, 2026
- High7.1FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized d…Check if you run itEPSS 0.27%Oct 13, 2026
- Medium5.4When the authorize() method is called with a maxAge parameter, the auth0.js library does not validate the auth_time claim in the resulting ID token against the request…Check if you run itEPSS 0.21%Oct 13, 2026
- Medium5.3When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request…Check if you run itEPSS 0.28%Oct 13, 2026
- Critical10.0ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation.Check if you run itEPSS 0.70%Oct 13, 2026
- Medium6.0FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body.Check if you run itEPSS 0.25%Oct 13, 2026
- High7.1FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the emulated SCardStatusA passes…Check if you run itEPSS 0.32%Oct 13, 2026
- High7.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.51%Oct 13, 2026
- High7.5Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.51%Oct 13, 2026
- UnknownMalicious code in @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm)Open the advisoryOct 13, 2026
- Low3.7fastify vulnerable to header validation bypass via case-sensitive propertyNamesCheck if you run itEPSS 0.26%Oct 13, 2026
- Medium5.5A vulnerability was determined in conductor-oss conductor up to 3.32.5.Check if you run itEPSS 0.35%Oct 13, 2026
- UnknownMerge pull request #825 from eliashaeussler/typo3-core-2026-10Check if you run itEPSS 0.51%Oct 13, 2026
- Critical10.0The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases.Check this weekEPSS 39.00%Oct 13, 2026
- Medium6.1ZDI-26-755: (0Day) Genesis World glTF Server-Side Request Forgery VulnerabilityOpen the advisoryOct 13, 2026
- Critical9.3Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint…Check if you run itEPSS 0.35%Oct 13, 2026
- Medium5.3A flaw has been found in PaddlePaddle PaddleX up to 3.7.2.Check if you run itEPSS 0.40%Oct 13, 2026
- Medium4.2GitLab has remediated an issue in GitLab EE affecting all versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions,…Check if you run itEPSS 0.13%Oct 13, 2026
- Low1.9A vulnerability was determined in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4.Check if you run itEPSS 0.11%Oct 13, 2026
- Low3.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.3 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain condition…Check if you run itEPSS 0.19%Oct 13, 2026
- High8.8SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query.Check if you run itEPSS 0.35%Oct 13, 2026
- Critical10.0The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.Check if you run itEPSS 0.27%Oct 13, 2026