Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownCVE-2026-94439 affecting package golang 1.27.1-1Open the advisoryOct 8, 2026
- UnknownCVE-2026-78663 affecting package python-tensorboard 2.16.2-6Open the advisoryOct 8, 2026
- UnknownCVE-2026-78663 affecting package golang 1.27.1-1Open the advisoryOct 8, 2026
- UnknownCVE-2026-78663 affecting package golang 1.26.7-1Open the advisoryOct 8, 2026
- High8.7TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443.Check if you run itEPSS 0.24%Oct 8, 2026
- High7.5HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently.Check if you run itEPSS 0.42%Oct 8, 2026
- UnknownHTTP/1 server connection desynchronization after 2xx CONNECT response in net/httpCheck if you run itEPSS 0.32%Oct 8, 2026
- UnknownDouble flow control refund on HTTP/2 server streams in net/httpCheck if you run itEPSS 0.57%Oct 8, 2026
- UnknownHTTP/2 server memory exhaustion due to Trailer headers in net/httpCheck if you run itEPSS 0.57%Oct 8, 2026
- HighHTTP/1 client connection desynchronization after CONNECT rejection in net/httpCheck if you run itEPSS 0.31%Oct 8, 2026
- Medium4.4Indico: Cross-Site-Scripting in minutes editorCheck if you run itEPSS 0.23%Oct 8, 2026
- High8.1MariaDB Connector/Node.js: SQL injection through object keys in SET expansion (permitSetMultiParamEntries)Check if you run itEPSS 0.45%Oct 8, 2026
- High7.5MariaDB Connector/Node.js exposes uninitialized process memory through malformed GeoJSON parametersCheck if you run itEPSS 0.39%Oct 8, 2026
- Medium5.3FFmpeg before 7.1.4 and 8.0.x before 8.0.2 contains a server-side request forgery vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redire…Check if you run itEPSS 0.26%Oct 8, 2026
- High7.1FFmpeg through 9.0.2 contains an infinite loop vulnerability in ff_rtsp_connect() in libavformat/rtsp.c that follows RTSP 3xx redirects without any redirect limit.Check if you run itEPSS 0.35%Oct 8, 2026
- LowPydantic AI OpenTelemetry instrumentation: retry prompt content is not redacted whenCheck if you run itEPSS 0.30%Oct 8, 2026
- Medium6.8AsyncHttpClient CookieStore Silently Overrides Caller's Explicit Cookie Header via setHeader (Bypass of CVE-2024-53990 Fix)Check if you run itEPSS 0.30%Oct 8, 2026
- Medium6.8AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPSCheck if you run itEPSS 0.36%Oct 8, 2026
- High7.4AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsCheck if you run itEPSS 0.19%Oct 8, 2026
- UnknownAsyncHttpClient: Cookie Domain attribute is not checked against the public suffix list, so a cookie can be set for co.ukCheck if you run itEPSS 0.26%Oct 8, 2026
- CriticalAsyncHttpClient: Replay to a different host sends the original host request and credentials to the new hostCheck if you run itEPSS 0.19%Oct 8, 2026
- Medium6.5IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow an authenticated user to…Check if you run itEPSS 0.14%Oct 8, 2026
- UnknownCisco NX-OS Software NX-API Remote Code Execution VulnerabilityCheck if you run itEPSS 0.52%Oct 8, 2026
- Medium4.9IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to server-side request…Check if you run itEPSS 0.14%Oct 8, 2026
- High8.4In Brocade ASCG before 3.5.0, a local unauthorized user on the ASCG VM who can issue a request to the SANnav host network namespace can extract stored management crede…Check if you run itEPSS 0.10%Oct 8, 2026