Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in several endpoints that lack input validation.Check if you run itEPSS 0.25%Oct 12, 2026
- Medium5.3Frappe before 15.113.3 and 16.x before 16.25.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks.Open the advisoryOct 12, 2026
- Medium5.9GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionary loader.Check if you run itEPSS 0.15%Oct 12, 2026
- Medium4.3Nango is an open-source platform for connecting agents and products to third-party APIs.Check if you run itEPSS 0.23%Oct 12, 2026
- High8.8Nginx UI is a web user interface for the Nginx web server.Check if you run itEPSS 0.43%Oct 12, 2026
- Medium6.0Flower before 2.2.0 contains a cross-site request forgery vulnerability because Tornado xsrf_cookies is disabled and the OAuth session cookie lacks SameSite.Check if you run itEPSS 0.14%Oct 12, 2026
- High8.3Nginx UI: MCP configuration tools bypass restricted directive validation and allow secondary authenticated users to execute NJS in Nginx worker contextCheck if you run itEPSS 0.28%Oct 12, 2026
- High7.2OWASP Coraza WAF is a golang modsecurity compatible web application firewall library.Check if you run itEPSS 0.50%Oct 12, 2026
- Critical9.1NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerability that allows a network-adj…Check if you run itEPSS 0.15%Oct 12, 2026
- High8.3Nginx UI OTP secure-session step-up is missing on sensitive mutation routesCheck if you run itEPSS 0.22%Oct 12, 2026
- High7.8containerd CRI plugin: Checkpoint restore bypasses destination security contextCheck if you run itEPSS 0.11%Oct 12, 2026
- Medium6.4A flaw was found in Quay.Check if you run itEPSS 0.21%Oct 12, 2026
- Medium6.5obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults.Check if you run itEPSS 0.24%Oct 12, 2026
- High7.5Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an…Check if you run itEPSS 0.32%Oct 12, 2026
- High7.5Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 use predictable CSRF tokens in Query Console.Check if you run itEPSS 0.15%Oct 12, 2026
- High7.7A flaw was found in the OpenShift console.Check if you run itEPSS 0.21%Oct 12, 2026
- High8.5Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations.Check if you run itEPSS 0.29%Oct 12, 2026
- High8.7Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root.Open the advisoryOct 12, 2026
- Medium5.3Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll.Check if you run itEPSS 0.20%Oct 12, 2026
- Medium6.9Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the c…Check if you run itEPSS 0.27%Oct 12, 2026
- High8.2Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery,…Open the advisoryOct 12, 2026
- Medium5.3Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an expli…Check if you run itEPSS 0.27%Oct 12, 2026
- High8.6Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to steal a signed-in user's sessio…Check if you run itEPSS 0.14%Oct 12, 2026
- Medium6.1FreeRDP 3.0.0 before 3.32.0 contains an integer truncation vulnerability in license_check_stream_length that allows a malicious RDP server to trigger a heap buffer ove…Check if you run itEPSS 0.46%Oct 12, 2026
- High7.4FreeRDP 3.0.0 before 3.32.0 contains an improper certificate validation vulnerability in freerdp_http_request() in libfreerdp/utils/http.c that completes TLS handshake…Check if you run itEPSS 0.19%Oct 12, 2026