Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7anchorme through 3.0.8 contains a regular expression denial of service vulnerability in the IPv6 host extraction regex due to catastrophic backtracking.Open the advisorySep 29, 2026
- Medium6.8Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)Check if you run itEPSS 0.38%Sep 29, 2026
- Medium6.1Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationCheck if you run itEPSS 0.31%Sep 29, 2026
- Unknownurllib3 is an HTTP client library for Python.Check if you run itEPSS 0.29%Sep 29, 2026
- High8.1Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability.Check if you run itEPSS 0.10%Sep 29, 2026
- UnknownExternal Control of File Name or PathPatch nowKEVEPSS 0.99%Sep 29, 2026
- UnknownApache OFBiz Exposure of Sensitive Information to an Unauthorized ActorPatch nowKEVEPSS 25.74%Sep 29, 2026
- UnknownImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 0.48%Sep 29, 2026
- UnknownUnrestricted Upload of File with Dangerous TypePatch nowKEVEPSS 1.71%Sep 28, 2026
- Unknown[20260909] - Core - SSRF vectors in various core extensionsCheck if you run itEPSS 0.24%Sep 25, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: virtio_ring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit iCheck if you run itEPSS 0.17%Sep 25, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr() cifs_posix_to_fattr() ignores…Check if you run itEPSS 0.20%Sep 25, 2026
- Medium6.5Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locatiCheck if you run itEPSS 0.40%Sep 25, 2026
- Critical9.1Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode because checkEndPointAuthenticationCredentCheck if you run itEPSS 0.39%Sep 25, 2026
- Critical9.1Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCreCheck if you run itEPSS 0.37%Sep 25, 2026
- Unknownelementor Website Builder Cross-Site Request Forgery (CSRF)Patch nowKEVEPSS 0.13%Sep 25, 2026
- High8.1In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix maximum allowed access checks The DACL permission check looks for an ACE matching the cu…Check if you run itEPSS 0.34%Sep 24, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3 The changes introduced to hand…Check if you run itEPSS 0.18%Sep 24, 2026
- UnknownIn the Linux kernel, the following vulnerability has been resolved: ACPI: bus: Introduce acpi_bus_get_primary_device() The function used for obtaining the first "physi…Check if you run itEPSS 0.20%Sep 24, 2026
- Medium6.4A server-side request forgery flaw was found in the Ansible Automation Platform automation-controller email notification backend.Check if you run itEPSS 0.17%Sep 23, 2026
- High7.3RabbitMQ: Stored XSS via TLS peer-certificate DN in management UICheck if you run itEPSS 0.30%Sep 23, 2026
- High7.6RabbitMQ: CORS * reflects Origin with Allow-CredentialsCheck if you run itEPSS 0.41%Sep 23, 2026
- High7.1RabbitMQ: Atom-table exhaustion via reply-to queue name decodingCheck if you run itEPSS 0.33%Sep 23, 2026
- High8.5CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC.Check if you run itEPSS 0.24%Sep 23, 2026
- Critical9.8SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requestsCheck if you run itEPSS 0.51%Sep 23, 2026