Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- UnknownCVE-2026-94439 affecting package golang 1.27.1-1Oct 8, 2026
- UnknownCVE-2026-78663 affecting package golang 1.27.1-1Oct 8, 2026
- UnknownCVE-2026-78663 affecting package golang 1.26.7-1Oct 8, 2026
- High7.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently.Oct 8, 2026
- Medium6.1When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.Oct 8, 2026
- High7.8Checksum database bypass for golang.org/toolchain in cmd/goOct 8, 2026
- High7.8Checksum bypass for golang.org/fips140 in cmd/goEPSS 0.1%Oct 8, 2026
- UnknownMemory limit bypass when parsing MIME headers in net/textproto, mime/multipartOct 8, 2026
- UnknownLack of limit on size of parsed Range headers in net/httpOct 8, 2026
- UnknownDouble flow control refund on HTTP/2 server streams in net/httpOct 8, 2026
- HighHTTP/2 transport accepts malformed framing-related headers in net/httpOct 8, 2026
- UnknownHTTP/2 server memory exhaustion due to Trailer headers in net/httpOct 8, 2026
- HighHTTP/1 client connection desynchronization after CONNECT rejection in net/httpOct 8, 2026
- CriticalHazelcast allows arbitrary member memory access by low-privileged clientEPSS 0.4%Oct 8, 2026
- Medium4.4Indico: Cross-Site-Scripting in minutes editorEPSS 0.2%Oct 8, 2026
- HighHazelcast has an authorization bypass in IMap Predicates APIEPSS 0.4%Oct 8, 2026
- High7.1PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypassOct 8, 2026
- High7.4MariaDB Connector/Node.js: SQL injection in the text protocol when the session uses NO_BACKSLASH_ESCAPESEPSS 0.4%Oct 8, 2026
- High8.1MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)EPSS 0.4%Oct 8, 2026
- High7.5MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parametersEPSS 0.4%Oct 8, 2026
- Medium5.9MariaDB Connector/Node.js: Uncaught exception crashes the client during ed25519 authentication with zero-configuration TLSEPSS 0.2%Oct 8, 2026
- HighCairoSVG: Quadratic-time DoS parsing a crafted SVGEPSS 0.4%Oct 8, 2026
- UnknownPraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDLOct 8, 2026
- LowPydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted whenEPSS 0.3%Oct 8, 2026
- Medium6.8AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)EPSS 0.3%Oct 8, 2026