Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.1In the Linux kernel, the following vulnerability has been resolved: ima: Instantiate file_truncate and path_truncate hooks Instantiate the file_truncate and path_trunc…Check if you run itEPSS 0.34%Aug 22, 2026
- Medium6.9NLTK before 3.10.0 (affected versions <= 3.9.4) contains a server-side request forgery (SSRF) vulnerability in the validate_network_url() function in nltk/pathsec.py.Check if you run itEPSS 0.33%Aug 22, 2026
- Critical9.1Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them.Check if you run itEPSS 0.50%Aug 22, 2026
- UnknownTenda g0_firmware Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 25.37%Aug 22, 2026
- High7.7TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation.Check if you run itEPSS 0.40%Aug 21, 2026
- High8.6Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - J2Commerce 4.1.5 is vulnerable to Stored Cross-Si…Check if you run itEPSS 0.52%Aug 21, 2026
- High8.7SpecifyJS is a declarative TypeScript user interface framework.Check if you run itEPSS 0.48%Aug 21, 2026
- High7.5Unleash is an open-source feature management platform.Check if you run itEPSS 0.70%Aug 21, 2026
- Medium5.5Unleash is an open-source feature management platform.Check if you run itEPSS 0.39%Aug 21, 2026
- High7.0OctoPrint provides a web interface for controlling consumer 3D printers.Check if you run itEPSS 0.32%Aug 21, 2026
- Medium5.9Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD.Check if you run itEPSS 0.50%Aug 21, 2026
- Medium5.9Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD.Check if you run itEPSS 0.54%Aug 21, 2026
- High7.5Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations.Check if you run itEPSS 0.62%Aug 21, 2026
- High7.1A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers.Check if you run itEPSS 0.27%Aug 21, 2026
- High7.1A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7.Check if you run itEPSS 0.47%Aug 21, 2026
- Medium6.9The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthentica…Check if you run itEPSS 0.53%Aug 21, 2026
- Critical10.0Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.Check if you run itEPSS 0.80%Aug 21, 2026
- High8.3OpenViking before 0.3.4 contains a server-side request forgery vulnerability that allows authenticated low-privilege attackers to access internal network services by s…Check if you run itEPSS 0.34%Aug 21, 2026
- High8.7to_abs_path in scripts/iib/tool.py normalised the requested path with os.path.normpath, which collapses dot segments but does not resolve symbolic links.Check if you run itEPSS 0.51%Aug 21, 2026
- High8.7is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator.Check if you run itEPSS 0.50%Aug 21, 2026
- Critical9.4Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding.Check if you run itEPSS 0.49%Aug 21, 2026
- Critical9.9Incus is a system container and virtual machine manager.Check if you run itEPSS 0.44%Aug 21, 2026
- Critical9.3Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header.Check if you run itEPSS 0.61%Aug 21, 2026
- High7.7Headroom's LLM proxy lets a client choose the upstream destination with the x-headroom-base-url request header.Check if you run itEPSS 0.59%Aug 21, 2026
- Critical9.8In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a tool call is dispatched.Check if you run itEPSS 0.25%Aug 21, 2026