Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownMicrosoft Windows Improper Link Resolution Before File Access ('Link Following')Patch nowKEVEPSS 0.37%Jul 10, 2026
- UnknownFlowiseAI Flowise Missing Authentication for Critical FunctionPatch nowKEVEPSS 2.05%Jul 8, 2026
- Low2.1swoosh has email-derived URL path injection in Microsoft Graph endpointCheck if you run itEPSS 0.20%Jul 6, 2026
- UnknownMicrosoft SharePoint Server Remote Code Execution VulnerabilityPatch nowKEVEPSS 15.17%Jun 24, 2026
- High8.8Google Chromium V8 Out-of-Bounds Read and Write VulnerabilityPatch nowKEVEPSS 2.44%Jun 8, 2026
- Critical9.2SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages.Check if you run itEPSS 0.41%Jun 4, 2026
- High7.0Nanobot prior to version 0.2.1 contains a server-side request forgery vulnerability in the Microsoft Teams channel handler that allows remote attackers to exfiltrate B…Check if you run itEPSS 0.66%Jun 1, 2026
- High8.0Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Office SharePoint allows an authorized attacker to execute code…Check if you run itEPSS 1.21%Jun 1, 2026
- Low2.0StrongDM Desktop Application before 23.74.0 (Desktop Client before 53.77.0) on Microsoft Windows stores authentication state, including a JSON Web Token and asymmetric…Check if you run itEPSS 0.13%May 29, 2026
- Medium5.5In the Linux kernel, the following vulnerability has been resolved: smb: client: use kzalloc to zero-initialize security descriptor buffer Commit 62e7dd0a39c2d ("smb:…Check if you run itEPSS 0.16%May 28, 2026
- High7.3This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.Patch nowKEVEPSS 0.17%May 28, 2026
- Critical9.8Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network.Check if you run itEPSS 0.90%May 22, 2026
- Critical10.0Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.Check if you run itEPSS 0.46%May 22, 2026
- High7.5Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.Check if you run itEPSS 0.92%May 22, 2026
- High7.5Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network.Check if you run itEPSS 1.73%May 22, 2026
- Critical9.3Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.Check if you run itEPSS 0.76%May 22, 2026
- Critical9.8Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network.Check if you run itEPSS 0.97%May 22, 2026
- High8.8Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network.Check if you run itEPSS 0.96%May 22, 2026
- High8.8Authorization bypass through user-controlled key in Azure Privileged Identity Management (PIM) allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.78%May 22, 2026
- Critical9.8Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.Check if you run itEPSS 0.86%May 22, 2026
- High7.7Improper input validation in Azure Compute Gallery allows an authorized attacker to disclose information over a network.Check if you run itEPSS 1.04%May 22, 2026
- High7.5Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network.Check if you run itEPSS 0.55%May 22, 2026
- Critical9.8Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code over a network.Check if you run itEPSS 0.58%May 22, 2026
- High8.8Microsoft SharePoint Server Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 2.70%May 22, 2026
- High8.1Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.Check if you run itEPSS 0.71%May 20, 2026