Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1Nodemailer from 3.0.0 before 10.0.10 contains a denial of service vulnerability in MessageParser.parseHeaders that allows users to exhaust CPU through quadratic header unfolding.Check if you run itEPSS 0.25%Oct 14, 2026
- Medium6.9Nodemailer from 3.0.0 before 10.0.13 contains an improper input validation vulnerability in its address parser that fails to strip RFC 5322 comments inside angle-bracket addresses.Check if you run itEPSS 0.22%Oct 14, 2026
- High8.7Nodemailer 3.0.0 before 10.0.13 ReDoS via SMTP AUTH Mechanism Detection RegexesCheck if you run itEPSS 0.30%Oct 14, 2026
- High8.4Renovate before 44.79.0 SSRF via HTTP Preset URLs and customDatasourcesCheck if you run itEPSS 0.23%Oct 14, 2026
- Critical9.0Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset.Check if you run itEPSS 0.28%Oct 14, 2026
- Medium5.3Renovate before 44.61.3 minimumReleaseAge Bypass via PR Rebase RequestCheck if you run itEPSS 0.21%Oct 14, 2026
- High7.1Renovate before 44.60.1 HTTP Header Allowlist Bypass via Shared PresetsCheck if you run itEPSS 0.18%Oct 14, 2026
- Critical9.1Better Auth 1.5.0-beta.12 before 1.7.7 Authentication Bypass via OAuth ProxyCheck if you run itEPSS 0.29%Oct 14, 2026
- High8.6Better Auth @better-auth/sso before 1.7.3 Authentication Bypass via Personal SSO ProvidersCheck if you run itEPSS 0.27%Oct 14, 2026
- Critical9.3Better Auth 1.4.0-beta.18 before 1.7.7 Authentication Bypass via Magic LinkCheck if you run itEPSS 0.32%Oct 14, 2026
- Medium6.3Better Auth drizzle-adapter 1.6.17 before 1.7.7 Rate Limit Bypass via Race ConditionCheck if you run itEPSS 0.22%Oct 14, 2026
- Medium6.9GitPython 3.1.62 before 3.2.0 Symlink Path Traversal via Submodule.move()Check if you run itEPSS 0.13%Oct 14, 2026
- High8.7GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch NameCheck if you run itEPSS 0.31%Oct 14, 2026
- Critical9.2GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() RefspecCheck if you run itEPSS 0.46%Oct 14, 2026
- High7.7GitPython before 3.2.0 Command Execution via ls_remote ext:: URLsCheck if you run itEPSS 0.42%Oct 14, 2026
- High8.7GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_dateCheck if you run itEPSS 0.28%Oct 14, 2026
- High7.1GitPython before 3.2.0 Environment Variable Disclosure via .gitmodules Submodule NameCheck if you run itEPSS 0.23%Oct 14, 2026
- High8.2Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit.Check if you run itEPSS 0.26%Oct 14, 2026
- High7.1n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSONCheck if you run itEPSS 0.23%Oct 14, 2026
- Medium6.3n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook ResolutionCheck if you run itEPSS 0.36%Oct 14, 2026
- Medium6.1n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create EndpointCheck if you run itEPSS 0.23%Oct 14, 2026
- High7.2n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node ParametersCheck if you run itEPSS 0.21%Oct 14, 2026
- High7.2n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File PreviewCheck if you run itEPSS 0.24%Oct 14, 2026
- Medium6.0n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connection MergeCheck if you run itEPSS 0.31%Oct 14, 2026
- High7.0n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss ParameterCheck if you run itEPSS 0.37%Oct 14, 2026