Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.1Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Apache Tomcat.Check if you run itEPSS 1.22%May 12, 2026
- Low3.7Observable Timing Discrepancy vulnerability when comparing AJP secret in Apache Tomcat.Check if you run itEPSS 0.53%May 12, 2026
- High7.5Improper Handling of Case Sensitivity vulnerability in LockOutRealm in Apache Tomcat.Check if you run itEPSS 0.50%May 12, 2026
- Critical9.8DEPRECATED: Authentication Bypass Issues vulnerability in digest authentication in Apache Tomcat.Check if you run itEPSS 1.33%May 12, 2026
- High7.3Exposure of HTTP Authentication Header to unexpected hosts during WebSocket authentication vulnerability in Apache Tomcat.Check if you run itEPSS 0.65%May 12, 2026
- Critical9.8Improper Input Validation vulnerability in Apache Tomcat.Check if you run itEPSS 1.68%May 12, 2026
- High7.5Allocation of Resources Without Limits or Throttling vulnerability in Apache Tomcat.Check if you run itEPSS 0.86%May 12, 2026
- Medium6.5The OpenSearch logging provider, when configured with a URL that embeds credentials (for example ), wrote the full host URL — including the embedded credentials — into…Check if you run itEPSS 0.66%May 11, 2026
- Medium6.5The Elasticsearch logging provider, when configured with a URL that embeds credentials (for example ), wrote the full host URL — including the embedded credentials — i…Check if you run itEPSS 0.66%May 11, 2026
- Critical9.5In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the SOAP extension's object deduplication mechanism stores point…Check if you run itEPSS 1.29%May 10, 2026
- High7.5The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0.Check if you run itEPSS 0.89%May 8, 2026
- Critical9.1Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants.Check if you run itEPSS 0.50%May 8, 2026
- High8.8Account users are allowed by default to register templates to be downloaded directly to the primary storage for deploying instances using the KVM hypervisor.Check if you run itEPSS 0.73%May 8, 2026
- Medium5.3Due to multiple time-of-check time-of-use race conditions in the resource count check and increment logic, as well as missing validations, users of the platform are ab…Check if you run itEPSS 0.43%May 8, 2026
- High8.1Missing MinIO policy cleanup on bucket deletion via Apache CloudStack allows users to retain access to buckets which they previously owned.Check if you run itEPSS 0.37%May 8, 2026
- High8.1The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0.Check if you run itEPSS 0.51%May 8, 2026
- Medium6.5The CloudStack Backup plugin has an improper access logic in versions 4.21.0.0 and 4.22.0.0.Check if you run itEPSS 0.53%May 8, 2026
- Medium6.5The CloudStack Backup plugin has an improper authorization logic in versions 4.21.0.0 and 4.22.0.0.Check if you run itEPSS 0.49%May 8, 2026
- Critical9.1Apache::Session versions through 1.94 for Perl re-creates deleted sessions.Check if you run itEPSS 0.36%May 8, 2026
- Critical9.0Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.Check if you run itEPSS 0.81%May 7, 2026
- Critical9.9Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.Check if you run itEPSS 0.78%May 7, 2026
- Medium5.3ParquetSharp is a .NET library for reading and writing Apache Parquet files.Check if you run itEPSS 0.45%May 7, 2026
- Critical9.2Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to a…Check if you run itEPSS 0.64%May 6, 2026
- Critical9.1Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure.Check if you run itEPSS 0.49%May 6, 2026
- Medium6.5FolderUploadsFileManager in Apache Wicket does not validate or sanitize the uploadFieldId parameter or the clientFileName before constructing file paths, allowing an u…Check if you run itEPSS 1.00%May 6, 2026