Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.7OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions.Open the advisoryOct 10, 2026
- Medium6.9Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds.Check if you run itEPSS 0.22%Oct 10, 2026
- High7.2Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, even when service.publicurl is set.Open the advisoryOct 9, 2026
- Medium5.3Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission checkOpen the advisoryOct 9, 2026
- Medium5.4Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenantsOpen the advisoryOct 9, 2026
- High7.1Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushesOpen the advisoryOct 9, 2026
- Medium5.3Contao: The registration module re-sends activation mailsCheck if you run itEPSS 0.26%Oct 9, 2026
- Low3.5Contao: Cross-site request forgery in custom backend actionsCheck if you run itEPSS 0.11%Oct 9, 2026
- Medium4.3Contao: Improper access control in the table access voterCheck if you run itEPSS 0.19%Oct 9, 2026
- UnknownAL26-024 - Critical vulnerabilities affecting Citrix NetScaler ADC and NetScaler Gateway – CVE-2026-88771 and CVE-2026-88772 – Update 2Check if you run itEPSS 0.47%Oct 9, 2026
- Medium5.4A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon.Check if you run itEPSS 0.14%Oct 9, 2026
- High8.8Improper input validation vulnerability in Apache Camel Karavan.Check if you run itEPSS 0.39%Oct 9, 2026
- UnknownSecurity update for python-PyJWTOpen the advisoryOct 9, 2026
- High7.5In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate before deciding to send it to the STS.Check if you run itEPSS 0.25%Oct 9, 2026
- High7.5Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query expressions.Check if you run itEPSS 0.32%Oct 9, 2026
- High8.1Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a remote attacker to obtain mul…Check if you run itEPSS 0.32%Oct 9, 2026
- Critical9.1The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a milliseconds/seconds unit mismatch and an inverted comparison polarity.Check if you run itEPSS 0.37%Oct 9, 2026
- High7.5By default, StaxUtils placed no limit on the total number of elements or the total number of characters in an XML document.Check if you run itEPSS 0.46%Oct 9, 2026
- High7.5In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the configured attachment-max-header-size (default 300 characters) and attac…Check if you run itEPSS 0.56%Oct 9, 2026
- High8.2Reusing a Nonce, Key Pair in EncryptionCheck if you run itEPSS 0.41%Oct 9, 2026
- High8.2Uncontrolled RecursionCheck if you run itEPSS 0.39%Oct 9, 2026
- Medium6.9An unauthenticated user with network access to the Ops Manager web port can repeatedly request monitoring endpoints that perform costly work without rate limiting.Check if you run itEPSS 0.25%Oct 9, 2026
- Criticaltheme-fusion avada_builder Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 0.43%Oct 9, 2026
- UnknownCVE-2026-97032 affecting package python-tensorboard 2.16.2-6Open the advisoryOct 8, 2026
- UnknownCVE-2026-97032 affecting package golang 1.27.1-1Open the advisoryOct 8, 2026