Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.8AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSEPSS 0.4%Oct 8, 2026
- High7.5AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabledEPSS 0.4%Oct 8, 2026
- High7.4AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsEPSS 0.2%Oct 8, 2026
- Low3.7AsyncHttpClient: Digest authentication cnonce generated with a non-cryptographic random sourceEPSS 0.3%Oct 8, 2026
- UnknownAsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukEPSS 0.3%Oct 8, 2026
- CriticalAsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostEPSS 0.2%Oct 8, 2026
- UnknownMalicious code in kiyoramarkets (npm)Oct 8, 2026
- HighLangflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource HandlersEPSS 0.2%Oct 7, 2026
- High8.5PraisonAI: Crawl4AI/Chromium backend is also affected by the SSRF validation bypassOct 7, 2026
- UnknownMalicious code in @ikyyjee/ikkysingle (npm)Oct 7, 2026
- Unknownlibexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c.Oct 7, 2026
- Medium5.4Gitea container registry stored XSS through blob media typeEPSS 0.2%Oct 6, 2026
- Critical9.1Gitea built-in SSH server authentication bypass through key case foldingEPSS 0.3%Oct 6, 2026
- High8.6Payload: SQL injection in SQLite/PostgresEPSS 0.3%Oct 6, 2026
- UnknownCGA-vp7j-h68x-gjjpOct 6, 2026
- High7.5CGA-xf2g-g86j-hw7cOct 6, 2026
- High7.1In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipw_process_probe_response() and the libipw_networkEPSS 0.3%Oct 6, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: only operate on TDLS peers in the TDLS code ieee80211_tdls_oper() can operate on the AP station,EPSS 0.2%Oct 6, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcp_rmem be set below 4096 We can hit a division by zero crash in tcp_rcvbuf_grow() and tcp_rcv_EPSS 0.2%Oct 6, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix bugs caused by switchdev deletion errors Allowing switchdev to prevent vlan deletion andEPSS 0.2%Oct 6, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: wifi: brcmsmac: fix UAF in brcms_free_timer() brcms_free_timer() calls brcms_del_timer() which uses the non-syncEPSS 0.2%Oct 6, 2026
- High7.5In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCP_Server_Info.rlist is allocated via kzalloc which zeroEPSS 0.4%Oct 6, 2026
- High7.8xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()Oct 6, 2026
- High7.0RDMA/rxe: insert mcg into mcg_tree only after rxe_mcast_add() succeedsOct 6, 2026
- UnknownRDMA/mad: Fix receive buffer leak when PKey enforcement failsOct 6, 2026