Catalog
Findings
Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.
- UnknownNginx UI: nginx config directive denylist (ValidateConfigFile) is bypassable via same-line ";" separation → authenticated directive injection (RCE on the official image)EPSS 0.4%Oct 15, 2026
- UnknownNginx UI: Account Takeover via Missing on User Management EndpointEPSS 0.3%Oct 15, 2026
- High7.7FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared moduleEPSS 0.2%Oct 15, 2026
- UnknownSliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG DecoderOct 15, 2026
- Medium6.5SFTPGo: Denial of service via malformed SSH channel requestEPSS 0.3%Oct 15, 2026
- High7.1Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode AttributeKEVEPSS 0.2%Oct 15, 2026
- MediumTerragrunt catalog predictable temp symlink clobberOct 15, 2026
- LowGitHub CLI allows attestation verification bypass through unescaped regex metacharactersEPSS 0.3%Oct 15, 2026
- LowGitHub CLI allows path traversal through unescaped request URL componentsEPSS 0.5%Oct 15, 2026
- Low3.3GitHub CLI partially discloses authentication tokens in outputEPSS 0.2%Oct 15, 2026
- Medium6.5Python Social Auth is a social authentication/registration mechanism.EPSS 0.2%Oct 15, 2026
- Unknownborg extract might modify out-of-tree files when extracting maliciously crafted archivesOct 15, 2026
- UnknownA stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service (DoS) via supplying a crafted .PSB subtitle file.EPSS 0.2%Oct 15, 2026
- High7.5An issue in Trisolutions BRPerfX version 1.4.4.0 exposes LDAP credentials in plaintext within the administrative configuration interface.EPSS 0.3%Oct 15, 2026
- UnknownExternal Control of File Name or PathKEVEPSS 0.4%Oct 15, 2026
- High8.8XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserController).EPSS 0.3%Oct 15, 2026
- High8.8ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.U…EPSS 0.3%Oct 15, 2026
- High7.5react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP.EPSS 0.4%Oct 15, 2026
- UnknownAUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.EPSS 0.8%Oct 15, 2026
- Medium6.5tinytag is a Python library for reading audio file metadata.EPSS 0.3%Oct 15, 2026
- High8.7AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework.EPSS 0.4%Oct 15, 2026
- High8.1Improper AuthenticationKEVEPSS 0.4%Oct 15, 2026
- Critical9.3The vulnerability exists within internal components of BeyondTrust’s Remote Support product.KEVEPSS 118.0%Oct 15, 2026
- Medium6.9Nuxt OG Image generates OG Images with Vue templates in Nuxt.EPSS 0.2%Oct 15, 2026
- High7.5OpenNext Cloudflare is an open Next.js adapter for Cloudflare.EPSS 0.3%Oct 15, 2026