Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 616 threats · Wednesday, Oct 21· last check 2026-11-04 07:13 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Wednesday, Oct 21

Most severe in everything

EXPLOITED IN THE WILD

PHP: out-of-memory handling flaw lets a web request run codephp79 talking

SUPPLY CHAINNO CVE YET

EXPLOITED IN THE WILD

litellm 1.107.0 on PyPI and Docker shipped a credential stealer and remote code loaderlitellm2 talking

CAMPAIGNNO CVE YET

EXPLOITED IN THE WILD

Lazarus (Operation FlashHole) abuses South Korea's mandatory INISAFE CrossWeb EX banking security software to run in-memory malware controlled through GitHub issuesINISAFE CrossWeb EX

TOTOLINK EX200 router: stack overflow via Wi-Fi ACL macAddress lets attackers run codeTOTOLINK EX200 firmware

Wednesday, Oct 21

MEDIUMINCIDENTCloudflare: Elevated Error Rate for Durable Objects in LisbonCloudflareVendor2026-10-21 23:50 UTCby status page–WHAT TO DO MEDIUM5.9Archer C6 router: shared hardcoded key lets attackers decrypt saved credentialsInfrastructure2026-10-21 23:17 UTCby EPSS–WHAT TO DO CRITICAL9.9Splunk SOAR: files and directories exposed to outside parties, fixed in 8.7.0Splunk SOARVendor2026-10-21 23:17 UTCby InfraStack Analyst–FIX 8.7.0 HIGH8.8Cisco: non-canonical URL paths let requests bypass authorization checksSplunk SOARInfrastructure2026-10-21 23:17 UTCby InfraStack Analyst–FIX 8.7.0 NOT SCOREDNOT SCOREDCisco: internally found flaws in a hardening release, CWE-424Vendor2026-10-21 23:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCisco: hardening release fixes internal protection-mechanism flaws, details withheldVendor2026-10-21 23:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCisco: hardening release fixes unspecified flaws in exception handlingVendor2026-10-21 23:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCisco: internal review hardening release fixes unspecified input-neutralization flawsInfrastructure2026-10-21 23:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCisco: hardening release fixes internal flaws in resource lifetime handlingInfrastructure2026-10-21 23:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCisco: internal review fixes grouped improper access control flawsVendor2026-10-21 23:17 UTCby EPSS–WHAT TO DO MEDIUM5.9Splunk SOAR: unauthenticated REST API call decrypts stored credential dataOther2026-10-21 23:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Splunk SOAR: any logged-in user can change the Enterprise Security license editionOther2026-10-21 23:17 UTCby EPSS–WHAT TO DO HIGH7.2Splunk SOAR: REST API filters let low-privilege users infer admin tokensOther2026-10-21 23:17 UTCby EPSS–WHAT TO DO HIGH7.5Splunk SOAR: Observer role can infer other users' password hashes and tokensPackage2026-10-21 23:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Splunk SOAR: users without app-view role can download app archivesOther2026-10-21 23:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Splunk SOAR: low-privilege users can download Automation Broker Docker configPackage2026-10-21 23:17 UTCby EPSS–WHAT TO DO MEDIUM5.7Splunk SOAR: app documentation runs attacker script in other users' browsersOther2026-10-21 23:17 UTCby EPSS–WHAT TO DO CRITICAL9.9Splunk Enterprise: hardening release fixes several critical internal flawsSplunk EnterpriseVendor2026-10-21 23:17 UTCby InfraStack Analyst–FIX 10.4.4 NOT SCOREDNOT SCOREDCisco: hardening release fixes several internal protection-mechanism weaknessesInfrastructure2026-10-21 23:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCisco: internal review hardening release fixes resource lifetime flawsVendor2026-10-21 23:17 UTCby EPSS–WHAT TO DO CRITICAL9.9Splunk Enterprise: improper access control flaws allow unauthorized actionsSplunk EnterpriseVendor2026-10-21 23:17 UTCby InfraStack Analyst–FIX 10.4.4 HIGH8.8Splunk Enterprise: non-admin users can run OS commands via database passwordRuntime2026-10-21 23:17 UTCby EPSS–WHAT TO DO MEDIUM4.2Splunk Enterprise: GET request lets phished user disable federated search providersPackage2026-10-21 23:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Splunk Enterprise: low-privilege users can change sourcetype renames in restricted appsVendor2026-10-21 23:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Splunk Enterprise: non-admin users can list dashboards and reports beyond filterOther2026-10-21 23:17 UTCby EPSS–WHAT TO DO MEDIUM4.3Splunk Enterprise: low-privilege users can move field extractions into unauthorized appsPackage2026-10-21 23:17 UTCby EPSS–WHAT TO DO HIGH7.2Splunk Enterprise: low-privilege users can run OS commands via Manager XMLInfrastructure2026-10-21 23:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Splunk Enterprise: low-privileged users can read other users' mobile alert dataPackage2026-10-21 23:17 UTCby EPSS–WHAT TO DO HIGH8.8Splunk Enterprise: scheduled searches skip risky-SPL safeguards, letting users alter dataRuntime2026-10-21 23:17 UTCby EPSS–WHAT TO DO HIGH7.5Splunk Enterprise: unauthenticated requests can exhaust resources and halt the daemonRuntime2026-10-21 23:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Splunk Enterprise: low-privilege user can crash instance via lookup REST APIRuntime2026-10-21 23:17 UTCby EPSS–WHAT TO DO HIGH7.5Splunk Enterprise: one crafted request takes Splunk Web offlineInfrastructure2026-10-21 23:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Splunk Enterprise: low-privilege users can read or delete other users' preview jobsRuntime2026-10-21 23:17 UTCby EPSS–WHAT TO DO HIGH7.5php-travel-agency-system: SQL injection in admin/update.php lets remote attackers query dataOther2026-10-21 23:17 UTCby EPSS–WHAT TO DO HIGH7.5oretnom23 PHP travel agency system: SQL injection in admin/delete.phpOther2026-10-21 23:17 UTCby EPSS–WHAT TO DO HIGH7.5PHP travel agency system: admin session handler lets attackers skip loginOther2026-10-21 23:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-106053 withdrawn by its CVE Numbering Authority, no flawOther2026-10-21 23:17 UTCby NVD–WHAT TO DO HIGH8.8Google SAM: unauthenticated enrollment endpoint leaks peer identity tokensgoogle/samPackage2026-09-06 16:01 UTCby InfraStack Analyst–FIX 0.1.0-alpha.9 MEDIUM6.8TP-Link Deco BE63: cloud daemon leaks plaintext TP-Link ID password to logged-in usersInfrastructure2026-10-21 23:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in dictanovaasr (PyPI)dictanovaasrPackage2026-10-21 23:09 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in orchestril (PyPI)orchestrilPackage2026-10-21 23:09 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in prosodinetts (PyPI)prosodinettsPackage2026-10-21 23:08 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in codecraze (PyPI)codecrazePackage2026-10-21 23:08 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in solivoxtts (PyPI)solivoxttsPackage2026-10-21 23:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tessivatts (PyPI)tessivattsPackage2026-10-21 23:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in vellutts (PyPI)velluttsPackage2026-10-21 23:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in grommatts (PyPI)grommattsPackage2026-10-21 23:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in zennittts (PyPI)zennitttsPackage2026-10-21 23:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in aurenatts (PyPI)aurenattsPackage2026-10-21 23:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in phonoviatts (PyPI)phonoviattsPackage2026-10-21 23:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in voxilaratts (PyPI)voxilarattsPackage2026-10-21 23:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in brummatts (PyPI)brummattsPackage2026-10-21 23:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in melcuratts (PyPI)melcurattsPackage2026-10-21 23:04 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in quillonatts (PyPI)quillonattsPackage2026-10-21 23:03 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in shellgrip (PyPI)shellgripPackage2026-10-21 23:03 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in batchspar (PyPI)batchsparPackage2026-10-21 23:02 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in crenelatts (PyPI)crenelattsPackage2026-10-21 23:01 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in journey-test-hellospy (PyPI)journey-test-hellospyPackage2026-10-21 22:40 UTCby osv-malicious–UNINSTALL HIGHINCIDENTOpenAI: Authentication errors for some usersOpenAIVendor2026-10-21 22:36 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @sudobility/testomniac_client (npm)@sudobility/testomniac_clientPackage2026-10-21 22:21 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @sudobility/indexer_client (npm)@sudobility/indexer_clientPackage2026-10-21 22:21 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @sudobility/wildduck_client (npm)@sudobility/wildduck_clientPackage2026-10-21 22:21 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @sudobility/shaperouter_client (npm)@sudobility/shaperouter_clientPackage2026-10-21 22:20 UTCby osv-malicious–UNINSTALL HIGHNOT SCOREDNet::LibSSH for Perl: connections skip host key verification, enabling man-in-the-middlePackage2026-10-21 22:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDRex for Perl: rsync transfers accept unknown SSH host keys, enabling interceptionPackage2026-10-21 22:16 UTCby EPSS–WHAT TO DO CRITICAL9.1Java SE JSSE: unauthenticated network flaw exposes critical data2 talkingRuntime2026-10-21 22:16 UTCby EPSS2talkingWHAT TO DO CRITICAL9.2PUBLIC EXPLOITLaravel TokenGuard authentication bypass through non-string API credentialslaravel/frameworkPackage2026-10-19 13:32 UTCby GitHub Advisories–FIX 13.29.0 MEDIUM6.5Laravel relationship inclusion can trigger unauthorized data destructionlaravel/frameworkPackage2026-10-19 13:33 UTCby GitHub Advisories–FIX 12.68.0 MEDIUM6.3Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1PillowPackage2026-10-19 09:47 UTCby GitHub Advisories–FIX 13.0.0 MEDIUM6.5itsourcecode Online Cake Ordering System: SQL injection via transactionsave.php del parameterOther2026-10-21 22:16 UTCby EPSS–WHAT TO DO CRITICAL10.0TOTOLINK EX200 router: stack overflow via Wi-Fi ACL macAddress lets attackers run codeTOTOLINK EX200 firmwareInfrastructure2026-10-21 22:16 UTCby InfraStack Analyst–WHAT TO DO CRITICAL10.0TOTOLINK EX200 extender: remote stack overflow in DHCP config lets attackers run codeTOTOLINK EX200 firmwareInfrastructure2026-10-21 22:16 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5Online Cake Ordering System: SQL injection via orderdetail.php ID parameterPackage2026-10-21 22:16 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDPerl Robots::Validate: stale matcher state flags real visitors as fake robotsPackage2026-10-21 22:16 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in libseal (PyPI)libsealPackage2026-10-21 22:02 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in iterquarry (PyPI)iterquarryPackage2026-10-21 22:01 UTCby osv-malicious–UNINSTALL HIGHNOT SCOREDNode.js: Wednesday, October 21, 2026 Security Releasesnode7 talkingRuntime2026-10-21 22:00 UTCby nodejs.org7talkingFIX 22.23.4 HIGHNOT SCOREDPillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tagsPillowPackage2026-10-21 21:29 UTCby GitHub Advisories–FIX 13.0.0 HIGH7.7PUBLIC EXPLOITPillow: Heap buffer overflow writing JPEG comment after ICC profile fills bufferPillowPackage2026-10-17 10:35 UTCby GitHub Advisories–FIX 13.0.0 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @worrisome/aaaa (npm)@worrisome/aaaaPackage2026-10-21 21:20 UTCby osv-malicious–UNINSTALL HIGH7.1Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)PillowPackage2026-10-17 10:34 UTCby GitHub Advisories–FIX 13.0.0 HIGH7.1Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic timePillowPackage2026-10-17 10:35 UTCby GitHub Advisories–FIX 13.0.0 HIGH7.1Pillow: TarIO negative size field causes infinite CPU-spin loopPillowPackage2026-10-17 10:42 UTCby GitHub Advisories–FIX 13.0.0 MEDIUM6.5Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromisepillowPackage2026-10-17 10:40 UTCby GitHub Advisories–FIX 13.0.0 HIGH8.2Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustionPillowPackage2026-10-17 10:36 UTCby GitHub Advisories–FIX 13.0.0 CRITICAL9.8Pillow multi-frame loaders can reuse stale native image storage after mode transitionsPillowPackage2026-10-17 10:32 UTCby GitHub Advisories–FIX 13.0.0 MEDIUM6.5Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute modepillowPackage2026-10-17 10:42 UTCby GitHub Advisories–FIX 13.0.0 HIGH7.1Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoSpillowPackage2026-10-17 10:34 UTCby GitHub Advisories–FIX 13.0.0 MEDIUM6.5Pillow: Decompression-bomb protection bypass via multi-frame seek() in MPO and DCX (MpoImageFile.seek / DcxImageFile.seek)PillowPackage2026-10-17 10:43 UTCby GitHub Advisories–FIX 13.0.0 HIGHNOT SCOREDViewSonic ViewBoard vCast: unauthenticated endpoint leaks live screen capturesInfrastructure2026-10-21 21:19 UTCby EPSS–WHAT TO DO HIGH8.6TastyIgniter: admin settings input runs code via PHP object injectiontastyigniter/tastyigniterPackage2026-10-21 21:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.8Red Hat CA store: weak eMudhra intermediates let attackers impersonate TLS sitesInfrastructure2026-10-21 21:17 UTCby EPSS–WHAT TO DO MEDIUM6.5itsourcecode Online Cake Ordering System: SQL injection via inserttrans.php prcdOther2026-10-21 21:17 UTCby EPSS–WHAT TO DO MEDIUM5.5EKKOLearnAI ekko-studio: output_path argument allows remote file inclusionAI agents & MCP2026-10-21 21:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Online Cake Ordering System 1.0: SQL injection in product deletion pageOther2026-10-21 21:17 UTCby EPSS–WHAT TO DO MEDIUM4.7wiki-go: comment deletion path traversal lets remote attackers reach other filesPackage2026-09-22 02:52 UTCby EPSS–WHAT TO DO HIGH7.5GitPython validates a submodule's ".git" path only after cloning into it (RCE)GitpythonPackage2026-10-14 12:22 UTCby GitHub Advisories–FIX 3.2.1 HIGH7.5toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()tomlPackage2026-10-12 23:00 UTCby GitHub Advisories–FIX 5.0.1 HIGH8.7toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()tomlPackage2026-10-12 23:00 UTCby GitHub Advisories–FIX 5.0.1 HIGH8.8toml-node: Prototype pollution: parsing a TOML document can write to Object.prototypetomePackage2026-10-12 23:01 UTCby GitHub Advisories–FIX 5.0.1 HIGH8.7toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()tomlPackage2026-10-12 23:00 UTCby GitHub Advisories–FIX 5.0.1 HIGH8.8nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidocnbconvertPackage2026-10-12 09:23 UTCby GitHub Advisories–FIX 7.17.2 CRITICAL9.1Sentry-Javascript: Middleware Bypass when using Tunnel route@sentry/nextjsPackage2026-09-24 13:48 UTCby GitHub Advisories–FIX 9.47.2 HIGH7.5Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiationdjangorestframeworkPackage2026-10-06 20:17 UTCby GitHub Advisories–FIX 3.18.2 HIGH7.4Django REST framework: TokenProxy.delete() reports success and revokes nothingdjangorestframeworkPackage2026-10-06 20:17 UTCby GitHub Advisories–FIX 3.18.2 LOWNOT SCOREDPerl Algorithm::UrataniTakeda: search cache grows without limit, exhausting memoryPackage2026-10-20 19:59 UTCby EPSS–WHAT TO DO HIGHINCIDENTCloudflare: Elevated Errors for R2 and Durable Objects in ENAMCloudflareVendor2026-10-21 20:43 UTCby status page–WHAT TO DO MEDIUM6.1OpenSCAP: crafted datastream can write files outside the target directoryInfrastructure2026-10-21 20:17 UTCby EPSS–WHAT TO DO MEDIUM4.2Keycloak: locale required action can skip mandatory OTP enrollment at loginPackage2026-10-21 20:17 UTCby EPSS–WHAT TO DO MEDIUM6.5wiki-go: path traversal in editor API lets remote users reach filesPackage2026-09-22 02:52 UTCby EPSS–WHAT TO DO MEDIUM6.5wiki-go: file rename API path traversal lets remote users reach other filesPackage2026-09-22 02:52 UTCby EPSS–WHAT TO DO MEDIUM4.3wiki-go: metadata fetch endpoint allows server-side request forgeryPackage2026-09-22 02:52 UTCby EPSS–WHAT TO DO MEDIUM6.5HarnessRouter: test endpoint lets remote users force server-side requestsAI agents & MCP2026-10-08 01:58 UTCby EPSS–WHAT TO DO HIGH7.5Django REST framework: JSONParser applies an attacker-named codec to the request streamdjangorestframeworkPackage2026-10-06 20:17 UTCby GitHub Advisories–FIX 3.18.2 HIGH8.8Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorizationjupyter-serverPackage2026-09-10 13:07 UTCby GitHub Advisories–FIX 2.6.0 HIGH8.2Apache Traffic Server: half-closed POST request crashes the proxy via null pointerRuntime2026-10-21 20:17 UTCby EPSS–WHAT TO DO MEDIUM6.9Apache Traffic Server: dropped chunked trailers can stall proxied transfers until timeoutRuntime2026-10-21 20:17 UTCby EPSS–WHAT TO DO CRITICAL10.0Apache Traffic Server: TLS session resumption skips client certificate check across SNI hostsRuntime2026-10-21 20:17 UTCby EPSS–WHAT TO DO CRITICAL10.0Apache Traffic Server: pooled TLS sessions reused across different client certificatesApache Traffic ServerInfrastructure2026-10-21 20:17 UTCby InfraStack Analyst–FIX 9.2.16 CRITICAL10.0Apache Traffic Server: clients can get proxy's AWS credentials to sign requestsRuntime2026-10-21 20:17 UTCby EPSS–WHAT TO DO CRITICAL9.4Apache Traffic Server: experimental tsmemcache plugin lets anyone read and wipe cacheRuntime2026-10-21 20:17 UTCby EPSS–WHAT TO DO HIGH8.7Apache Traffic Server: crafted headers flood the diagnostic logRuntime2026-10-21 20:17 UTCby EPSS–WHAT TO DO CRITICAL9.3Apache Traffic Server: HEAD requests enable request smuggling past proxiesRuntime2026-10-21 20:17 UTCby EPSS–WHAT TO DO HIGH8.6Apache Traffic Server: malformed HTTP/2 frame exhausts origin worker poolApache Traffic ServerRuntime2026-10-21 20:17 UTCby InfraStack Analyst–FIX 9.2.16 HIGH8.6Apache Traffic Server: truncated HTTP/2 Content-Length exhausts origin worker poolsRuntime2026-10-21 20:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTAnthropic: Degraded performance for Claude Fable 5AnthropicVendor2026-10-21 19:49 UTCby status page–WHAT TO DO MEDIUMINCIDENTCircleCI: Increased Docker gen2 wait timesCircleCIVendor2026-10-21 19:31 UTCby status page–WHAT TO DO HIGH7.1Zephyr: stale I2C register state causes NULL dereference in MCTP targetRuntime2026-10-21 18:07 UTCby EPSS–WHAT TO DO MEDIUM6.3Zephyr NPCX eSPI driver: oversized TAF flash request overflows controller memoryRuntime2026-10-21 17:23 UTCby EPSS–WHAT TO DO HIGH7.0Zephyr RTOS: timer race lets a local thread corrupt kernel memoryRuntime2026-10-21 16:00 UTCby EPSS–WHAT TO DO MEDIUM4.2Zephyr Infineon PSOC 6 Bluetooth driver races, can leak adjacent RAM to peersRuntime2026-10-21 15:47 UTCby EPSS–WHAT TO DO MEDIUM5.2Zephyr: AFBR-S50 sensor driver double-completes RTIO submissions, corrupting memoryPackage2026-10-21 16:45 UTCby EPSS–WHAT TO DO MEDIUM5.3Zephyr: unprivileged user threads can switch devmux console routingRuntime2026-10-21 18:17 UTCby EPSS–WHAT TO DO HIGH7.8Zephyr: PECI syscall lets user threads write kernel memoryRuntime2026-10-21 17:24 UTCby EPSS–WHAT TO DO LOW3.5Zephyr Bluetooth A2DP: oversized codec IE leaks adjacent RAM to a paired peerRuntime2026-10-21 15:42 UTCby EPSS–WHAT TO DO MEDIUM6.3HarnessRouter: forged org headers bypass authorization in Identity Mode gatewayAI agents & MCP2026-10-07 19:55 UTCby EPSS–WHAT TO DO CRITICAL9.9PUBLIC EXPLOITTenda BE3L Pro router: remote buffer overflow in Wi-Fi setup takes controlTenda BE3L ProInfrastructure2026-10-21 19:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5SourceCodester Food Order Management System: admin endpoint lacks authorization checksFood Order Management SystemPackage2026-10-21 19:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5ProjectWorlds Library Management System: SQL injection in profile.php via admin_idOther2026-10-21 19:17 UTCby EPSS–WHAT TO DO HIGH8.8PUBLIC EXPLOITMongoDB Compass: crafted view opens and runs code as the userPackage2026-10-21 19:17 UTCby EPSS–WHAT TO DO MEDIUM5.2Checkmk: local user with write access escalates to root via Oracle pluginInfrastructure2026-10-21 19:16 UTCby EPSS–WHAT TO DO CRITICAL9.3Apache Traffic Server: malformed 302 responses enable cache poisoning and desyncRuntime2026-10-21 19:16 UTCby EPSS–WHAT TO DO CRITICAL10.0Apache Traffic Server: unauthenticated clients control ImageMagick convert argumentsRuntime2026-10-21 19:16 UTCby EPSS–WHAT TO DO HIGH8.8Apache Traffic Server: wasm plugin use-after-free lets guest code corrupt memoryApache Traffic ServerRuntime2026-10-21 19:16 UTCby InfraStack Analyst–FIX 10.1.5 MEDIUM6.5Tailored Tools WordPress plugin: CSRF lets attackers trigger admin actionsPackage2026-10-21 19:16 UTCby EPSS–WHAT TO DO HIGH8.7Vaadin Framework 8: crafted request freezes sessions and exhausts thread poolPackage2026-10-21 19:16 UTCby EPSS–WHAT TO DO HIGH8.4Vaadin Charts: bundled Highcharts flaws allow XSS and prototype pollutionPackage2026-09-29 11:43 UTCby EPSS–WHAT TO DO HIGH7.7Apache Pulsar: package version field lets users reach other tenants' packagesRuntime2026-10-21 19:16 UTCby EPSS–WHAT TO DO CRITICAL10.0Apache Pulsar Manager: unauthenticated takeover and leaked cluster admin credentialpulsar-managerPackage2026-10-21 19:16 UTCby InfraStack Analyst–WHAT TO DO HIGH7.7Apache Pulsar: proxy role lets forwarded users exceed their own permissionsPackage2026-10-21 19:16 UTCby EPSS–WHAT TO DO LOW2.3Apache Pulsar: authenticated users can clear or delete subscriptions they should not reachPackage2026-10-21 19:16 UTCby EPSS–WHAT TO DO HIGH8.7Apache Pulsar: shadow topics let a tenant admin read another tenant's messagesPackage2026-10-21 19:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Apache Pulsar: any authenticated client can list installed connector catalogPackage2026-10-21 19:16 UTCby EPSS–WHAT TO DO MEDIUM4.9Apache Pulsar: Functions Worker trigger endpoint skips topic produce authorizationPackage2026-10-21 19:16 UTCby EPSS–WHAT TO DO HIGH7.2Apache Pulsar: authenticated users can truncate partitioned topics they should notPackage2026-10-21 19:16 UTCby EPSS–WHAT TO DO LOW2.3Apache Pulsar: failed topic load silently disables required message encryptionPackage2026-10-21 19:16 UTCby EPSS–WHAT TO DO LOW2.3Apache Pulsar: non-persistent topic entry filter policy editable without permissionPackage2026-10-21 19:16 UTCby EPSS–WHAT TO DO LOW2.3Apache Pulsar: broker REST API leaks transaction metadata across tenantsPackage2026-10-21 19:16 UTCby EPSS–WHAT TO DO HIGH8.7Apache Traffic Server: Expect 100-continue request smuggling past front-end proxiesRuntime2026-10-21 19:16 UTCby EPSS–WHAT TO DO CRITICAL9.1Apache Traffic Server: request smuggling lets attackers bypass access controls and poison cacheApache Traffic ServerRuntime2026-10-21 19:16 UTCby InfraStack Analyst–FIX 9.2.16 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in journey-test-helloshell (PyPI)journey-test-helloshellPackage2026-10-21 18:30 UTCby osv-malicious–UNINSTALL HIGH7.2NoMachine nxhtd: unauthenticated server-side request forgery leaks internal informationNoMachineOther2026-10-21 18:17 UTCby InfraStack Analyst–FIX 10.1.7 HIGH7.8NoMachine: weak Redis credentials let local users escalate privilegesPackage2026-10-21 18:17 UTCby EPSS–WHAT TO DO HIGH8.8NoMachine: mDNS parser heap overflow lets network attackers run codeNoMachineOther2026-10-21 18:17 UTCby InfraStack Analyst–FIX 10.1.7 HIGH8.8MindsDB: authenticated user can run Python code through OpenBBtablemindsdbAI agents & MCP2026-10-21 18:17 UTCby InfraStack Analyst–FIX 26.1.0 (unconfirmed)HIGH8.8CrewAI: agent loading from repository lets a malicious config run codecrewaiAI agents & MCP2026-10-21 18:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.1BusyBox: libarchive symlink traversal lets a file write outside the target directoryInfrastructure2026-10-21 18:17 UTCby EPSS–WHAT TO DO HIGH7.7Airbyte OneDrive connector: SSRF lets authenticated users read internal resourcesPackage2026-10-21 18:17 UTCby EPSS–WHAT TO DO HIGH7.7ZDI-26-703Airbyte SharePoint connector: authenticated SSRF leaks data via shared drive lookupairbytePackage2026-10-21 18:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8Luxion KeyShot: BIP file parsing loads library from unsafe pathOther2026-10-21 18:17 UTCby EPSS–WHAT TO DO HIGH7.8GIMP: APNG file parsing overflow lets a malicious file run codePackage2026-10-21 18:17 UTCby EPSS–WHAT TO DO CRITICAL9.1PUBLIC EXPLOITMikroTik RouterOS WebFig: replayed session tokens grant persistent admin accessRouterOSInfrastructure2026-10-21 18:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.2LocalAI: gallery config redirects let attackers reach internal and cloud metadataLocalAIAI agents & MCP2026-10-21 18:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.0gin-vue-admin: path traversal in removePlugin lets admins delete directoriesPackage2026-10-16 02:48 UTCby EPSS–WHAT TO DO MEDIUM6.9pdfmake: SVG image references bypass local file access policyPackage2026-10-21 18:17 UTCby EPSS–WHAT TO DO MEDIUM6.5ProjectWorlds Library Management System: SQL injection in returned book searchOther2026-10-21 18:17 UTCby EPSS–WHAT TO DO MEDIUM5.8ProjectWorlds Library Management System: SQL injection in edit_member.phpOther2026-10-21 18:17 UTCby EPSS–WHAT TO DO HIGH7.5ProjectWorlds Library Management System: SQL injection via roll_number parameterOther2026-10-21 18:17 UTCby EPSS–WHAT TO DO HIGH7.5file-management-system: unrestricted file upload in FileController store endpointMomoTommy/file-management-systemOther2026-10-21 18:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM4.3DigitalME eRoom Zoom meetings plugin: missing authorization check, versions through 1.7.1Package2026-10-21 18:17 UTCby EPSS–WHAT TO DO MEDIUM5.4Nuxt server islands render `useHeadSafe` input without sanitisationnuxtRuntime2026-10-16 18:58 UTCby GitHub Advisories–FIX 4.6.2 MEDIUM6.3Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitivenuxtPackage2026-10-16 18:59 UTCby GitHub Advisories–FIX 4.6.2 MEDIUM6.5Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routesnuxtPackage2026-10-16 16:58 UTCby GitHub Advisories–FIX 4.4.4 LOW2.3Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disablednuxtPackage2026-10-16 16:59 UTCby GitHub Advisories–FIX 4.6.0 MEDIUM6.2stream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of servicestream-jsonPackage2026-09-19 23:38 UTCby GitHub Advisories–FIX 3.7.0 MEDIUM6.5Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX renderingastroPackage2026-10-12 18:13 UTCby GitHub Advisories–FIX 7.3.2 LOW2.3Astro: Arbitrary CSS injection in Astro View TransitionsastroPackage2026-10-12 18:13 UTCby GitHub Advisories–FIX 7.3.3 HIGH8.7Storybook dev server vulnerable to code injection from the local networkstorybookPackage2026-10-12 19:13 UTCby GitHub Advisories–FIX 8.6.19 LOW3.9Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometryelectronRuntime2026-10-15 21:22 UTCby GitHub Advisories–FIX 42.11.6 MEDIUM4.3H5P: authorization bypass through a user-controlled key, versions through 1.17.9Package2026-10-21 18:17 UTCby EPSS–WHAT TO DO HIGH7.8NoMachine: named pipe permissions let local users gain SYSTEMRuntime2026-10-21 18:17 UTCby EPSS–WHAT TO DO CRITICAL9.8GStreamer: RTP L16 depayloader heap overflow lets remote attackers run codegst-plugins-goodPackage2026-10-21 18:17 UTCby InfraStack Analyst–FIX 1.28.8 HIGH7.2multicluster-global-hub operator: overly broad RBAC allows cluster-wide impersonationmulticluster-global-hub-operator-bundleInfrastructure2026-10-21 18:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.0Apache Pulsar: functions can read packages from other tenants' namespacesRuntime2026-10-21 18:17 UTCby EPSS–WHAT TO DO LOW2.3Apache Pulsar: WebSocket consumers can inject messages into unauthorized topicsPackage2026-10-21 18:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Apache Pulsar: schema commands skip topic authorization, exposing and altering schemasPackage2026-10-21 18:17 UTCby EPSS–WHAT TO DO CRITICAL9.2Apache Pulsar: forged token roles let anonymous HTTP and WebSocket requests gain super-user accessPackage2026-10-21 18:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in pixel-map-testmetest (npm)pixel-map-testmetestPackage2026-10-21 18:00 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in test-brotli2-testmetest (npm)test-brotli2-testmetestPackage2026-10-21 18:00 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in test-brotli-testmetest (npm)test-brotli-testmetestPackage2026-10-21 18:00 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTSentry: Increased latency processing integration webhooksSentryVendor2026-10-21 17:53 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in log-sink-testmetest (npm)log-sink-testmetestPackage2026-10-21 17:30 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: Silent Network Authentication (SNA) Missing Redirects and Gateway API (Lookup API) Failure Increase in NetherlandsTwilioVendor2026-10-21 17:26 UTCby status page–WHAT TO DO CRITICAL8.6Storybook: Missing origin validation in Storybook preview allows code injection from malicious websitesstorybookPackage2026-10-12 19:13 UTCby GitHub Advisories–FIX 8.6.19 HIGH7.8Snort 3: local control socket lets low-privilege users run commandsPackage2026-10-21 17:19 UTCby EPSS–WHAT TO DO HIGH7.5Cisco IOS XR: crafted IPv4 packets can crash ASR 9000 line cardsInfrastructure2026-10-21 17:19 UTCby EPSS–WHAT TO DO MEDIUM6.6Cisco Expressway: insecure temporary files flaw from internal security reviewVendor2026-10-21 17:19 UTCby EPSS–WHAT TO DO HIGH7.0Cisco Expressway: hardening release fixes multiple improper link resolution flawsVendor2026-10-21 17:19 UTCby EPSS–WHAT TO DO HIGH7.8Cisco Expressway: incorrect permission assignments allow unauthorized access, unknown impactCisco Expressway SeriesInfrastructure2026-10-21 17:19 UTCby InfraStack Analyst–FIX X15.5.20 HIGH7.8Cisco Expressway: code injection flaws allow code execution, patched in hardening releasesInfrastructure2026-10-21 17:19 UTCby EPSS–WHAT TO DO HIGH7.5Cisco Expressway: uncaught exceptions in hardening releases allow service disruptionInfrastructure2026-10-21 17:19 UTCby EPSS–WHAT TO DO HIGH7.5Cisco Expressway: null pointer flaws in hardening releaseCisco Expressway Series (Expressway-C and Expressway-E)Infrastructure2026-10-21 17:19 UTCby InfraStack Analyst–FIX X15.5.20 HIGH7.5Cisco Expressway: reachable assertions let remote requests crash the applianceInfrastructure2026-10-21 17:19 UTCby EPSS–WHAT TO DO HIGH8.6Cisco Expressway: out-of-bounds write flaws may let attackers run codeInfrastructure2026-10-21 17:19 UTCby EPSS–WHAT TO DO MEDIUM5.8Cisco Snort 3: unreleased memory from file processing enables remote denial of serviceInfrastructure2026-10-21 17:19 UTCby EPSS–WHAT TO DO MEDIUM5.3Cisco Unified CM: crafted HTTP request bypasses access controls remotelyInfrastructure2026-10-21 17:19 UTCby EPSS–WHAT TO DO HIGH7.5Cisco Unified Communications: improper exception handling flaws, hardening releasesCisco Unified Communications ManagerInfrastructure2026-10-21 17:19 UTCby InfraStack Analyst–FIX 15SU5 HIGH7.8Cisco Unified Communications products: path traversal flaw in hardening releaseCisco Unified Communications ManagerInfrastructure2026-10-21 17:19 UTCby InfraStack Analyst–FIX 15SU5 HIGH8.8Cisco Unified Communications: improper access control lets attackers bypass restrictionsCisco Unified Communications Manager (Unified CM, IM&P, SME), Unity Connection, Emergency Responder, Prime Collaboration DeploymentInfrastructure2026-10-21 17:19 UTCby InfraStack Analyst–FIX 15SU5 HIGH8.8Cisco Unified Communications Manager: SQL injection flaws in several productsCisco Unified Communications ManagerInfrastructure2026-10-21 17:19 UTCby InfraStack Analyst–FIX 15SU5 HIGH8.8Cisco Unified CM and Unity Connection: input validation flaws, CVSS 8.8Cisco Unified Communications ManagerVendor2026-10-21 17:19 UTCby InfraStack Analyst–FIX 15SU5 CRITICAL9.3PUBLIC EXPLOITCisco Unified CM and Unity Connection: web page input flaws allow script injectionCisco Unified Communications ManagerInfrastructure2026-10-21 17:19 UTCby InfraStack Analyst–FIX 15SU5 CRITICAL9.8PUBLIC EXPLOITCisco Unified CM and Unity Connection: improper authentication flaw, criticalCisco Unified Communications ManagerInfrastructure2026-10-21 17:19 UTCby InfraStack Analyst–FIX 15SU5 CRITICAL9.8PUBLIC EXPLOITCisco Unified Communications Manager and Unity Connection: critical flaws fixed in 15SU5Cisco Unified Communications ManagerInfrastructure2026-10-21 17:19 UTCby InfraStack Analyst–FIX 15SU5 CRITICAL9.8PUBLIC EXPLOITCisco Expressway: unauthenticated remote root command execution via database serviceCisco Expressway Series (Expressway-C/E)Infrastructure2026-10-21 17:19 UTCby InfraStack Analyst–FIX X15.5.20 MEDIUM5.5Cisco Secure Client: local IPC flaw lets attackers elevate privilegesOther2026-10-21 17:19 UTCby EPSS–WHAT TO DO MEDIUM5.3Cisco Snort 3: crafted GTP fragmented UDP packet causes detection engine restartPackage2026-10-21 17:19 UTCby EPSS–WHAT TO DO MEDIUM5.3Cisco Expressway: unauthenticated MRA request leaks sensitive device informationInfrastructure2026-10-21 17:19 UTCby EPSS–WHAT TO DO MEDIUM6.9Girafit camera app and devices ship shared hardcoded TURN credentialsInfrastructure2026-10-21 17:18 UTCby EPSS–WHAT TO DO HIGH7.5Snort 3: multiple uncontrolled resource consumption flaws found in reviewInfrastructure2026-10-21 17:18 UTCby EPSS–WHAT TO DO HIGH7.8Snort 3: privilege management flaws let local users gain higher rightsPackage2026-10-21 17:18 UTCby EPSS–WHAT TO DO HIGH7.5Snort 3: hardening fixes for internal flaws in incorrect calculationInfrastructure2026-10-21 17:18 UTCby EPSS–WHAT TO DO MEDIUM5.8Cisco Snort 3: crafted nested GRE traffic restarts the detection engineInfrastructure2026-10-21 17:18 UTCby EPSS–WHAT TO DO MEDIUM5.8Cisco Snort 3: crafted VBA data crashes the detection engineInfrastructure2026-10-21 17:18 UTCby EPSS–WHAT TO DO MEDIUM5.8Cisco Snort 3: crafted Teredo packet crashes packet inspection engineInfrastructure2026-10-21 17:18 UTCby EPSS–WHAT TO DO MEDIUM5.8Cisco Snort 3: crafted GRE packet crashes intrusion detection engineInfrastructure2026-10-21 17:18 UTCby EPSS–WHAT TO DO CRITICAL9.0Snort 3: out-of-bounds writes in Cisco firewall and IOS XE inspection engineSnort 3Package2026-10-21 17:18 UTCby InfraStack Analyst–FIX 3.12.4.0 MEDIUM5.8Cisco Snort 3: crafted NetFlow packet crashes the detection engineVendor2026-10-21 17:18 UTCby EPSS–WHAT TO DO MEDIUM5.8Cisco Snort 3: crafted SMTP MIME headers crash the detection engineInfrastructure2026-10-21 17:18 UTCby EPSS–WHAT TO DO HIGH7.5MomoTommy file-management-system: Files API lacks authentication, remote file accessMomoTommy/file-management-systemPackage2026-10-21 17:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5File Management System PHP: missing auth lets remote users delete foldersOther2026-10-21 17:18 UTCby EPSS–WHAT TO DO CRITICAL7.5oretnom23 file-management-system-php: unrestricted file upload via save_filesfile-management-system-phpOther2026-10-21 17:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5File Management System PHP: SQL injection in files.php lets remote attackers query dataPackage2026-10-21 17:18 UTCby EPSS–WHAT TO DO HIGH7.5D365 F&O MCP Server: blank API key leaves X++ source readable anonymouslyPackage2026-08-12 09:03 UTCby EPSS–WHAT TO DO LOW3.9Electron: Frame subscription trusts GPU-supplied frame geometryelectronRuntime2026-10-15 21:23 UTCby GitHub Advisories–FIX 42.11.6 MEDIUM5.4Electron: openExternal permission requests can be attributed to the wrong originelectronRuntime2026-10-15 21:22 UTCby GitHub Advisories–FIX 42.11.3 MEDIUM5.4Electron: HID and USB permission checks can be attributed to the wrong originelectronRuntime2026-10-15 21:22 UTCby GitHub Advisories–FIX 45.0.0-alpha.5 MEDIUM5.4Electron: Pointer lock permission requests can be attributed to the wrong frameelectronPackage2026-10-15 21:27 UTCby GitHub Advisories–FIX 45.0.0-alpha.13 LOW3.1Electron: Extension tabs.query returns tab URLs and titles without the tabs permissionelectronPackage2026-10-15 21:27 UTCby GitHub Advisories–FIX 45.0.0-alpha.4 MEDIUM4.2Electron: SameSite cookie restrictions are not applied to windows opened from linkselectronPackage2026-10-15 22:04 UTCby GitHub Advisories–FIX 45.0.0-alpha.6 MEDIUMINCIDENTTwilio: SMS Delivery Delays from a Subset of Twilio Short Codes to Cellularone NE Arizona United StatesTwilioVendor2026-10-21 17:10 UTCby status page–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Failures from a Subset of Twilio Alphanumeric Sender Type to Jazz PakistanTwilioVendor2026-10-21 16:42 UTCby status page–WHAT TO DO MEDIUMINCIDENTCloudflare: Increased Latency in IndiaCloudflareVendor2026-10-21 16:42 UTCby status page–WHAT TO DO MEDIUM5.3Slack Morphism verifier errors disclose valid HMACs in the logsslack-morphismPackage2026-09-19 23:18 UTCby GitHub Advisories–FIX 2.28.0 MEDIUMINCIDENTTwilio: SMS Delivery Delays and Failures from Twilio Short Codes to Multiple Networks in IndiaTwilioVendor2026-10-21 16:32 UTCby status page–WHAT TO DO LOWINCIDENTSupabase: Intermittent connection errors via the connection pooler in us-east-1SupabaseVendor2026-10-21 16:27 UTCby status page–WHAT TO DO HIGH7.8hMailServer: scoped admin accounts gain full server control over COMhMailServerPackage2026-10-21 16:17 UTCby InfraStack Analyst–FIX 6.3.7 HIGH8.1hMailServer: domain-confined admins can reroute mail across tenantsPackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.8hMailServer: infected single-part messages delivered unchanged when attachments are strippedPackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.9hMailServer: forwarded mail can pass DMARC for a hosted domainPackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO MEDIUM4.3hMailServer: domain-confined API keys can read server-wide traffic totalsPackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO HIGH7.5hMailServer: REST API role removal lets domain admin become server adminPackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.5hMailServer: domain-confined admin can edit roles across tenantsPackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.9hMailServer: forged From header lets forwarded mail pass SPF and DMARCPackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.0hMailServer: forged SRS addresses let attackers relay mail outwardPackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO LOW3.7hMailServer: idle connections can stall TLS certificate renewal over ACMEPackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO MEDIUM4.7hMailServer: SMTP log leaks login credentials and tokens in plain textPackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.3hMailServer: cross-site requests ride cached Basic credentials to the REST APIPackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDHermes Agent: webhook route names with colons escalate toolset privilegesAI agents & MCP2026-10-21 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.0Velneo vServer: link following lets local users reach unintended filesOther2026-10-21 16:17 UTCby EPSS–WHAT TO DO LOW3.7Undertow: symlink check lets static file requests reach sibling directoriesRuntime2026-10-21 16:17 UTCby EPSS–WHAT TO DO HIGH7.5oretnom23 file-management-system-php: SQL injection in download.php via IDfile-management-system-phpOther2026-10-21 16:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5oretnom23 file-management-system-php: SQL injection in folder and file handlersOther2026-10-21 16:17 UTCby EPSS–WHAT TO DO HIGH7.5oretnom23 file-management-system-php: SQL injection in user account save functionOther2026-10-21 16:17 UTCby EPSS–WHAT TO DO HIGH7.5oretnom23 file-management-system-php: login SQL injection allows database accessfile-management-system-phpPackage2026-10-21 16:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5File Management System PHP: index.php page argument enables remote file inclusionfile-management-system-phpOther2026-10-21 16:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.0pypdf: Possible large memory usage for streams with multiple filterspypdfPackage2026-10-09 10:50 UTCby GitHub Advisories–FIX 6.20.0 MEDIUM6.0pypdf: Possible infinite loop when hitting EOF in standard xref tablepypdfPackage2026-10-12 14:49 UTCby GitHub Advisories–FIX 6.20.0 MEDIUM6.0pypdf: Possible infinite loop when removing tree itemspypdfPackage2026-10-12 16:15 UTCby GitHub Advisories–FIX 6.20.1 MEDIUM6.0pypdf: Possible infinite loop in PdfWriter.find_outline_itempypdfPackage2026-10-12 16:16 UTCby GitHub Advisories–FIX 6.20.1 MEDIUM6.0pypdf: Possible large memory usage when parsing content streamspypdfPackage2026-10-16 10:27 UTCby GitHub Advisories–FIX 6.21.0 MEDIUM6.0pypdf: Possible large memory usage when parsing arrays and dictionariespypdfPackage2026-10-16 10:28 UTCby GitHub Advisories–FIX 6.21.0 MEDIUM6.0pypdf: Possible long runtimes/large memory usage when retrieving form fieldspypdfPackage2026-10-16 10:31 UTCby GitHub Advisories–FIX 6.21.0 CRITICAL9.4Lagoon Kubernetes platform: ssh service flaw lets logged-in users run codeOther2026-08-25 20:54 UTCby EPSS–WHAT TO DO MEDIUM6.1odf-kit: unescaped CSS values in HTML output allow attribute injectionPackage2026-10-19 00:46 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-102536 was rejected: development-only issue, no distributed version affectedOther2026-10-21 16:17 UTCby NVD–WHAT TO DO HIGH7.5NTPsec ntpd: oversized NTS nonce field lets remote attackers crash the daemonRuntime2026-10-21 16:17 UTCby EPSS–WHAT TO DO MEDIUM5.2NTPsec: out-of-bounds read in Oncore GPS driver crashes ntpd or leaks memoryPackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO MEDIUM6.4NTPsec: JJY refclock overflow lets a time source crash or corrupt ntpdPackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO HIGH7.5NTPsec ntpd: crafted NTS request lets remote attacker terminate the daemonInfrastructure2026-10-21 16:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDGPAC MP4Box: crafted AC4 file triggers use-after-free and crashPackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDGPAC MP4Box: crafted AC4 file crashes the parser with a NULL dereferencePackage2026-10-21 16:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Failures from United Kingdom to a Subset of Twilio Long CodesTwilioVendor2026-10-21 16:10 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in event-emitter-testmetest (npm)event-emitter-testmetestPackage2026-10-21 16:00 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in data-pipeline-testmetest (npm)data-pipeline-testmetestPackage2026-10-21 16:00 UTCby osv-malicious–UNINSTALL MEDIUM4.8Duplicate Advisory: chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-Forgithub.com/go-chi/chi/v5Package2026-10-21 15:42 UTCby GitHub Advisories–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in peptide-modify (npm)peptide-modifyPackage2026-10-21 15:41 UTCby osv-malicious–UNINSTALL HIGHINCIDENTSupabase: Project lifecycle operations such as project creation, pausing, and restoration, in all regionsSupabaseVendor2026-10-21 15:36 UTCby status page–WHAT TO DO MEDIUMINCIDENTOpenAI: Elevated error rates for gpt-5.6-luna API requestsOpenAIVendor2026-10-21 15:34 UTCby status page–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel BPF verifier: 32-bit zero-extension bug may leak upper register bitsRuntime2026-10-21 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.5itsourcecode Sales-and-Inventory-System: SQL injection via cust_searchfrm.php ID parameterOther2026-10-21 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.5itsourcecode Sales-and-Inventory-System: SQL injection in cust_del.php via IDOther2026-10-21 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.5itsourcecode Sales-and-Inventory-System: SQL injection in customer edit pageOther2026-10-21 15:17 UTCby EPSS–WHAT TO DO LOW2.3pypdf: Unvalidated JPEG image data loadingpypdfPackage2026-10-17 10:31 UTCby GitHub Advisories–FIX 6.21.1 HIGH8.8pfSense REST API package: sync-permission users can escalate to adminPackage2026-07-29 03:46 UTCby EPSS–WHAT TO DO HIGH7.1SureCart WordPress plugin: stored XSS through input handling before 4.9.5Package2026-10-21 15:17 UTCby EPSS–WHAT TO DO CRITICAL9.3Ajax Search Lite WordPress plugin: blind SQL injection lets attackers read the databasePackage2026-10-21 15:17 UTCby EPSS–WHAT TO DO HIGH7.1Geo Mashup WordPress plugin: reflected XSS through 1.13.22Package2026-10-21 15:17 UTCby EPSS–WHAT TO DO HIGH7.1Paid Videochat Turnkey Site: reflected XSS lets attackers run scripts in visitors' browsersOther2026-10-21 15:17 UTCby EPSS–WHAT TO DO HIGH7.1ThemeHunk Customizer WordPress plugin: reflected XSS through 2.8.7Package2026-10-21 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Contest Gallery WordPress plugin: stored XSS through unsanitized inputPackage2026-10-21 15:17 UTCby EPSS–WHAT TO DO MEDIUM6.5WooCommerce Swish plugin: missing authorization check exposes store functionsPackage2026-10-21 15:17 UTCby EPSS–WHAT TO DO CRITICAL9.9WordPress Mang Board WP: unrestricted upload lets attackers plant web shellsPackage2026-10-21 15:17 UTCby EPSS–WHAT TO DO HIGH7.5weForms WordPress plugin: path traversal through versions up to 1.6.28Package2026-10-21 15:17 UTCby EPSS–WHAT TO DO CRITICAL10.0WP Mailster WordPress plugin: unrestricted upload lets attackers plant web shellswp-mailsterPackage2026-10-21 15:17 UTCby InfraStack Analyst–FIX 1.9.2.0 MEDIUM5.5GPAC MP4Box: crafted MP4 file crashes the tool, causing denial of servicePackage2026-10-21 15:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDGPAC MP4Box: crafted MP4 file crashes the tool with a segmentation faultPackage2026-10-21 15:17 UTCby EPSS–WHAT TO DO MEDIUM5.5GPAC MP4Box: crafted MP4 file crashes the tool via stack overflowPackage2026-10-21 15:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDGPAC MP4Box: crafted MP4 file triggers heap use-after-free crashPackage2026-10-21 15:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDGPAC MP4Box: heap use-after-free lets a crafted MP4 crash itPackage2026-10-21 15:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDGPAC MP4Box: crafted XML file crashes the tool with a segfaultPackage2026-10-21 15:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDGPAC MP4Box: crafted MPEG-2 file crashes the tool via use-after-freePackage2026-10-21 15:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDLinux kernel: Bluetooth ISO service data copy flaw, impact unclearInfrastructure2026-10-21 15:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: Customer's Unable to Create New Requests for Hosting and PortingTwilioVendor2026-10-21 15:07 UTCby status page–WHAT TO DO CRITICALINCIDENTGitHub: Delays for Pull Requests and Webhook deliveriesGitHubVendor2026-10-21 14:52 UTCby status page–WHAT TO DO MEDIUMINCIDENTOpenAI: Elevated FedRAMP API error rates for Astra and SolOpenAIVendor2026-10-21 14:17 UTCby status page–WHAT TO DO MEDIUM6.3chi: Client IP spoofing in ClientIPFromXFF via X-Forwarded-Forgithub.com/go-chi/chi/v5Package2026-10-12 11:26 UTCby GitHub Advisories–FIX 5.4.0 HIGH7.5Insurance-Management-System: policy holder update form lacks authorization checksInsurance-Management-SystemPackage2026-10-21 14:17 UTCby InfraStack Analyst–WHAT TO DO LOW2.3WarehousePG: missing privilege check lets low-privileged users add fake standbyPackage2026-10-21 14:17 UTCby EPSS–WHAT TO DO HIGH7.1WarehousePG: any login role can freeze catalog changes cluster-widePackage2026-10-21 14:17 UTCby EPSS–WHAT TO DO MEDIUM5.3WarehousePG: low-privileged role can read other sessions' query text via logsPackage2026-10-21 14:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDGPAC MP4Box: crafted AC4 file triggers out-of-bounds read, crashing the toolPackage2026-10-21 14:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDGPAC MP4Box: crafted MP4 file causes denial of service crashPackage2026-10-21 14:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDGPAC MP4Box: crafted MPEG-4 file crashes the tool with a NULL dereferencePackage2026-10-21 14:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDTurnkey: sub-organization access tokens survive password reset, role change, disablementVendor2026-10-21 14:17 UTCby EPSS–WHAT TO DO MEDIUM5.8WSO2 products: external user store leaks which usernames existVendor2026-10-21 14:17 UTCby EPSS–WHAT TO DO MEDIUM4.0Unnamed product logs sensitive data sent in URL parametersOther2026-10-21 14:17 UTCby EPSS–WHAT TO DO MEDIUM4.8Authentication flows skip reCaptcha even when the option is enabledOther2026-10-21 14:17 UTCby EPSS–WHAT TO DO MEDIUM6.1Authentication endpoint XSS lets attackers run scripts in browsersOther2026-10-21 14:17 UTCby EPSS–WHAT TO DO MEDIUM5.4WSO2 API Manager: callback URL parameter enables open redirect phishingInfrastructure2026-10-21 14:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDPUBLIC EXPLOITCloudflare deploys protections against php2shell vulnerability | Cloudflare Blog4 talkingRuntime2026-10-21 13:56 UTCby PoC on GitHub4talkingWHAT TO DO HIGH7.5BIND: recursion-desired query sequence crashes recursive resolver with RPZ configInfrastructure2026-10-21 13:21 UTCby EPSS–WHAT TO DO HIGH7.5BIND: redirect zone with strict qname minimization crashes resolverInfrastructure2026-10-21 13:21 UTCby EPSS–WHAT TO DO HIGH8.1PUBLIC EXPLOITBIND named: replayed GSS-TSIG UDP messages corrupt memory, possibly allowing code execution1 talkingRuntime2026-10-21 13:21 UTCby EPSS1talkingWHAT TO DO MEDIUMNOT SCOREDApache bRPC: zero-length MySQL response packet crashes the client processPackage2026-10-21 13:20 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDApache bRPC: malformed Discovery reply crashes clients that refresh server listsPackage2026-10-21 13:20 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache bRPC: internal_port lets requests skip authentication on a shared connectionPackage2026-10-21 13:20 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDApache bRPC: builtin services let remote users write files and stall profilersPackage2026-10-21 13:20 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache bRPC: HTTP parser flaws allow request smuggling behind proxiesPackage2026-10-21 13:20 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDApache bRPC: builtin services reachable from public port over protobuf protocolsPackage2026-10-21 13:20 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDApache bRPC: padded URL paths bypass front-proxy access control rulesPackage2026-10-21 13:20 UTCby EPSS–WHAT TO DO MEDIUM5.4bRPC: RTMP abort message frees a chunk stream still in usePackage2026-10-21 13:20 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDApache bRPC: RTMP createStream null pointer crash lets remote clients stop serverRuntime2026-10-21 13:20 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache bRPC: RDMA data race lets a remote client crash the serverPackage2026-10-21 13:20 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDApache bRPC: assertion lets a remote peer crash the client processPackage2026-10-21 13:20 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDbRPC Thrift client: malformed server reply crashes the whole processPackage2026-10-21 13:20 UTCby EPSS–WHAT TO DO HIGH7.5Apache bRPC: deeply nested mcpack requests crash the server processPackage2026-10-21 13:20 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDbRPC: malformed stream feedback frame crashes the whole server processRuntime2026-10-21 13:20 UTCby EPSS–WHAT TO DO HIGH7.5BIND: crafted DNS messages make the resolver burn CPU and memory1 talkingInfrastructure2026-10-21 13:18 UTCby EPSS1talkingWHAT TO DO MEDIUM6.1e107 CMS: reflected XSS in search.php author parameterPackage2026-10-21 08:01 UTCby EPSS–WHAT TO DO HIGH8.7Velneo vServer: array index flaw in versions 36.0 to 36.6 and 37.0 to 37.2Other2026-10-21 13:18 UTCby EPSS–WHAT TO DO MEDIUM6.1PHPPresentation: HTML writer lets crafted PPTX inject script into pagesPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO CRITICAL9.2PHPPresentation: crafted PPTX file triggers PHP object injection and code executionphpoffice/phppresentation1 talkingPackage2026-10-21 13:18 UTCby InfraStack Analyst1talkingWHAT TO DO MEDIUM5.3Trudesk: authenticated users can overwrite files outside upload folderPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO MEDIUM6.9Trudesk: regex injection at login lets attackers enumerate valid usernamesPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO HIGH8.2Trudesk: unauthenticated download of private ticket attachmentsPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO HIGH7.0Trudesk: path traversal in backup API lets admins delete arbitrary filesPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO MEDIUM5.4Trudesk: any logged-in user uploads scripts served as stored XSSPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO HIGH8.3Trudesk: debug routes let unauthenticated users wipe data and log inPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO HIGH7.1Trudesk: search parameter injects code into MongoDB queriestrudeskPackage2026-10-21 13:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.3Trudesk: authenticated users can post messages as other usersPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO MEDIUM5.3Trudesk: authenticated users can forge comments and tickets as other usersPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO MEDIUM5.3Trudesk: any logged-in user can edit tickets outside their groupsPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO MEDIUM6.9Trudesk: authenticated users can read tickets outside their groupsPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO HIGH7.1ZenTao PMS: authorization bypass lets logged-in users reach admin AJAX methodsPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO MEDIUM6.9Chamilo LMS: missing authorization lets users harvest names and certificatesPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO MEDIUM5.3Chamilo LMS: missing authorization lets students read others' exam gradesPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO MEDIUM6.9Chamilo LMS: unauthenticated users can change gradebook certificates for any coursePackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO HIGH8.8Shopper admin panel: low-privilege users can grant themselves full adminPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO MEDIUM6.3Pydantic AI Harness tool-call limit bypass in nested CodeMode callspydantic-ai-harnessAI agents & MCP2026-10-21 13:18 UTCby GitHub Advisories–FIX 0.59.0 MEDIUM5.5Insurance Management System: plan form lets remote users change data without loginOther2026-10-21 13:18 UTCby EPSS–WHAT TO DO HIGH7.5Insurance Management System: admin registration form allows improper authorizationInsurance-Management-SystemOther2026-10-21 13:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5Insurance-Management-System: SQL injection in policy holder editor lets attackers read databasePackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO MEDIUM5.4SchedulePress: Contributor users can change any post's status and datePackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO MEDIUM5.3WpTravelly WordPress plugin: missing authorization check exposes tour bookingsPackage2026-10-21 13:18 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache bRPC: streaming RPC lets one request exhaust server memoryPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDApache bRPC: unbounded stream reassembly lets remote peers exhaust server memoryPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDApache bRPC: malformed stream response lets a server crash client or leak memoryPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDApache bRPC: streaming RPC skips authentication, letting unauthenticated peers inject framesPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDApache bRPC: unbounded decompression and parsing lets remote clients exhaust memoryPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache bRPC: unauthenticated HTTP/2 frames can crash server or exhaust memoryPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache bRPC: crafted HPACK headers crash HTTP/2 and gRPC serversPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache bRPC: crafted RTMP Abort message crashes server via use-after-freePackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache bRPC: crafted mcpack request forces huge memory allocation and crashPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDbRPC: zero-length mcpack2 string field crashes the server processPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDApache bRPC: TLS clients accept certificates issued for other hostnamesRuntime2026-10-21 12:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDbRPC: high-bit URL bytes crash the server on ARM64Package2026-10-21 12:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDApache bRPC: body size limit not enforced, enabling memory exhaustion denial of servicePackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDApache IoTDB: missing authentication lets unauthenticated users reach a critical functionPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache IoTDB: Legacy Pipe receiver runs data loads and deletes as rootPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDApache bRPC: inline Redis parsing allocates whole buffer, enabling memory denial of serviceRuntime2026-10-21 12:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache bRPC: empty Redis array header causes out-of-bounds write and crashPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDApache bRPC: RTMP AMF parser allocates memory from attacker-declared lengthsPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO HIGH7.5Apache bRPC: malformed HTTP/2 DATA frame crashes servers remotelyPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache bRPC: deeply nested AMF data from RTMP peers crashes the processRuntime2026-10-21 12:17 UTCby EPSS–WHAT TO DO MEDIUMNOT SCOREDApache bRPC: deeply nested Redis reply crashes the client processPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache bRPC: HTTP/2 header decoding recursion lets remote attackers crash serversPackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDApache bRPC: keep-alive connection bypasses authentication on HTTP endpointsRuntime2026-10-21 12:17 UTCby EPSS–WHAT TO DO HIGH7.5Insurance-Management-System: SQL injection in editPlan.php lets remote attackers query the databasePackage2026-10-21 12:17 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in moveworks-capi-starter (PyPI)moveworks-capi-starterPackage2026-10-21 11:27 UTCby osv-malicious–UNINSTALL LOW3.3Acronis Cyber Infrastructure: improper authorization exposes and alters sensitive dataInfrastructure2026-10-21 11:17 UTCby EPSS–WHAT TO DO CRITICAL9.1Acronis Cyber Infrastructure: missing authorization exposes and alters sensitive dataAcronis Cyber InfrastructureInfrastructure2026-10-21 11:17 UTCby InfraStack Analyst–FIX 6.0.1-112 NOT SCOREDNOT SCOREDApache IoTDB: Thrift RPC authentication bypass in versions 2.0.0 to 2.0.10Package2026-10-21 11:17 UTCby EPSS–WHAT TO DO NOT SCOREDNOT SCOREDApache IoTDB JDBC driver: uncontrolled resource consumption from crafted inputPackage2026-10-21 11:17 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Delays from Twilio to Orange FranceTwilioVendor2026-10-21 10:23 UTCby status page–WHAT TO DO HIGH7.1Live Summary for Gravity Forms: reflected XSS runs script in visitors' browsersPackage2026-10-21 10:16 UTCby EPSS–WHAT TO DO HIGH8.8WordPress GS Pins for Pinterest: untrusted data object injection flawPackage2026-10-21 10:16 UTCby EPSS–WHAT TO DO HIGH8.8WordPress Team Members plugin: object injection lets attackers run codePackage2026-10-21 10:16 UTCby EPSS–WHAT TO DO MEDIUM4.0Qt VectorImage QML: malicious SVG causes null-pointer crashPackage2026-10-21 10:16 UTCby EPSS–WHAT TO DO HIGH7.5Unbound: DNS-over-QUIC stale pointer lets remote client crash resolverPackage2026-10-21 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Unbound DNS resolver: crafted replies can exhaust CPU during name decompressionPackage2026-10-21 09:17 UTCby EPSS–WHAT TO DO HIGH8.8Jane Menu WordPress plugin: unauthenticated visitors can inject scripts into pagesjane-menuPackage2026-10-21 09:17 UTCby InfraStack Analyst–FIX 1.5.1 HIGH8.4OnePlus OxygenOS: logging HAL lets root-level callers run arbitrary shell commandsVendor2026-10-21 09:17 UTCby EPSS–WHAT TO DO HIGH8.5OnePlus OxygenOS: any installed app gets root shell via atlasserviceVendor2026-10-21 09:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Unbound DNS resolver: forged NXDOMAIN can deny records in trust islandsInfrastructure2026-10-21 09:17 UTCby EPSS–WHAT TO DO LOW3.7Unbound: forged NSEC reply can mark a trust island as insecurePackage2026-10-21 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.4HappyForms WordPress plugin: unescaped referral value injects HTML into admin emailsPackage2026-10-21 09:17 UTCby EPSS–WHAT TO DO LOW3.3Go storage archive layer code leaks file descriptors on malicious inputPackage2026-10-21 09:17 UTCby EPSS–WHAT TO DO HIGH8.7Eclipse OpenJ9 JITServer: malformed network messages crash the JVMRuntime2026-10-21 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Unbound: cache clear side-channel leaks upstream port, enabling cache poisoningRuntime2026-10-21 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Contest Gallery WordPress plugin: vote limit bypassed by spoofed visitor identityPackage2026-10-21 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3LatePoint WordPress plugin: bookings confirmed without paymentPackage2026-10-21 09:17 UTCby EPSS–WHAT TO DO LOW2.7Simple Shopping Cart WordPress plugin lets contributors set product pricesPackage2026-10-21 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3WordPress Simple Shopping Cart: forged PayPal notices mark unpaid orders as paidPackage2026-10-21 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3Telcell WordPress payment plugin accepts forged payment notifications, marking orders paidPackage2026-10-21 09:17 UTCby EPSS–WHAT TO DO MEDIUM5.3WordPress CMP maintenance plugin leaks whitelisted pages to visitorsPackage2026-10-21 09:17 UTCby EPSS–WHAT TO DO CRITICALINCIDENTSentry: Sentry.io not loading in US regionSentryVendor2026-10-21 08:54 UTCby status page–WHAT TO DO MEDIUM6.5Red Hat OpenShift AI: evaluation job leaks model secret and enables SSRFAI agents & MCP2026-10-21 08:16 UTCby EPSS–WHAT TO DO HIGH8.7Eclipse OpenJ9: crafted JITServer message crashes the JVM via heap readRuntime2026-10-21 08:16 UTCby EPSS–WHAT TO DO HIGH8.7Eclipse OpenJ9: crafted TCP connections halt JITServer compilation without loginRuntime2026-10-21 08:16 UTCby EPSS–WHAT TO DO HIGH7.1Ninja Forms WordPress plugin: stored XSS through form input up to 3.15.5Package2026-10-21 08:16 UTCby EPSS–WHAT TO DO HIGH7.1WordPress Strong Testimonials plugin: stored XSS through version 3.3.12Package2026-10-21 08:16 UTCby EPSS–WHAT TO DO LOW3.7Cart Abandonment Recovery for WooCommerce: unsigned tokens let attackers alter cartsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM4.3OpenStack Cinder: Messages API leaks other projects' resource UUIDs to usersInfrastructure2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Click n Chat WordPress plugin: unauthenticated download of all captured contact recordsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH8.6WordPress Click n Chat plugin: unauthenticated SQL injection via sort parameterPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH8.6WordPress Click n Chat plugin: unauthenticated SQL injection via column parameterPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH7.5WordPress Weglot plugin: unescaped URLs let visitors store browser-running payloadsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.5Wava Payment WordPress plugin: unauthenticated REST endpoint rewrites merchant credentialsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Wava Payment WordPress plugin lets anyone change WooCommerce order statusPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM4.3WordPress Download Manager plugin: CSRF lets attackers change admin privacy and storage settingsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH7.5Formidable Forms WordPress plugin: unauthenticated users can block payment verificationPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.8Elementor WordPress plugin: SVG text lets contributors run scriptsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.4Elementor WordPress plugin: uploaded SVG files can run JavaScript in browsersPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH7.1Advanced File Manager WordPress plugin: stored SVG script runs in admin browsersPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO CRITICAL9.9PUBLIC EXPLOITOpenStack Manila: any project member can control other tenants' public sharesmanilaInfrastructure2026-10-21 06:16 UTCby InfraStack Analyst–FIX 20.0.3 MEDIUM5.3TI WooCommerce Wishlist plugin leaks private wishlists through its REST APIPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM5.3SUMIT WooCommerce gateway: unauthenticated users can mark unpaid orders paidPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM5.9WholesaleX WordPress plugin exposes imported user data file publiclyPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.5WholesaleX WordPress plugin: unauthenticated account activation bypasses admin approvalPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH7.5WordPress 2FA plugin lets password-holding attacker bypass second factor via passkeyPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH7.1User Profile Builder WordPress plugin: reflected XSS on admin pagesPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM5.5Pricing Table WordPress plugin lets contributors clone and publish others' private contentPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Kliken Ads WordPress plugin leaks other customers' order detailsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH7.5Redirection for Contact Form 7 WordPress plugin: stored XSS via lead debug metaboxPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM4.9AI Engine WordPress plugin lets editors change posts they cannot editPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.8Swift Performance Lite WordPress plugin: SQL injection by author-role usersPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH8.1WP User Manager: paid registration grants admin role without paymentPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM4.9WPZOOM Portfolio Lite WordPress plugin lets contributors convert others' postsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM4.3Productive Commerce WordPress plugin: missing capability check lets subscribers activate pluginsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH7.1WP Booking System WordPress plugin: reflected XSS on admin pagesPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM5.3SureCart WordPress plugin: anonymous REST API leaks private merchant catalog dataPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.8HireZoot WordPress plugin: stored XSS lets authors attack administratorsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM5.3SmartyParcel WordPress plugin leaks shipping labels without authorisation checksPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM4.3SmartyParcel WordPress plugin lets any logged-in user delete shipping labelsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH7.5Simple Banner WordPress plugin: low-privilege roles gain full administrator rightsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH8.2WP Time Capsule plugin: subscriber can overwrite live WordPress sitePackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM5.0WordPress LearnDash toolkit: subsite admin can lock out network usersPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH7.5Uncanny Toolkit for LearnDash WordPress plugin: forged reset sets any user's passwordPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.5Moloni WordPress plugin: low-privilege users can issue invoices and edit productsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Booking Package WordPress plugin leaks calendar settings and admin email addressesPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Booking Package WordPress plugin: unauthenticated reset disables paid featuresPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM4.8WordPress Booking Package plugin: predictable cancellation tokens expose bookingsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM5.3Ettrick Escape Room Booking WordPress plugin: unpaid bookings can be marked paidPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH8.0Falang WordPress plugin: subscribers can store scripts that run for adminsPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO LOW2.7Appointment Booking WordPress plugin: agents can read every customer's recordPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM5.3WordPress Idram payment plugin accepts forged payment confirmations, marking orders paidPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH7.7Modern Events Calendar WordPress plugins: SQL injection lets subscribers read databasePackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO MEDIUM6.5Synchrony Financing WordPress plugin: unauthenticated REST route alters WooCommerce ordersPackage2026-10-21 06:16 UTCby EPSS–WHAT TO DO HIGH7.1Cerberus FTP Server: UNC path injection leaks service account NTLM hashOther2026-10-21 05:16 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in my-auto-follow-eltio (npm)my-auto-follow-eltioPackage2026-10-21 04:23 UTCby osv-malicious–UNINSTALL MEDIUM6.2libmodulemd: crafted module metadata crashes YAML serialization via out-of-bounds readPackage2026-10-21 04:18 UTCby EPSS–WHAT TO DO MEDIUM6.2libmodulemd: unbounded decompression of compressed YAML causes denial of servicePackage2026-10-21 04:18 UTCby EPSS–WHAT TO DO MEDIUM6.2libmodulemd: deeply nested module metadata exhausts stack, crashing parserPackage2026-10-21 04:18 UTCby EPSS–WHAT TO DO MEDIUM4.0DT42 BerryNet: path traversal in model metadata handler exposes server filesAI agents & MCP2026-10-21 04:18 UTCby EPSS–WHAT TO DO MEDIUM6.5Advanced Library Management System: SQL injection via report search datesOther2026-10-21 04:18 UTCby EPSS–WHAT TO DO HIGH5.3Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entriesuvPackage2026-10-21 03:32 UTCby GitHub Advisories–WHAT TO DO MEDIUM4.7Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages@sveltejs/kitPackage2026-10-21 03:32 UTCby GitHub Advisories–WHAT TO DO MEDIUM4.7Duplicate Advisory: SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions@sveltejs/kitPackage2026-10-21 03:32 UTCby GitHub Advisories–WHAT TO DO CRITICAL8.1Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code executionvllmAI agents & MCP2026-10-21 03:32 UTCby GitHub Advisories–FIX 0.31.0 HIGH7.5Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargsvllmAI agents & MCP2026-10-21 03:32 UTCby GitHub Advisories–WHAT TO DO HIGH7.5Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronizationvllmAI agents & MCP2026-10-21 03:32 UTCby GitHub Advisories–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @alannxd/baileys (npm)@alannxd/baileysPackage2026-10-21 03:24 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: Voice Call Post Dial Delay From a Subset of Twilio Phone Numbers to IsraelTwilioVendor2026-10-21 03:10 UTCby status page–WHAT TO DO MEDIUMINCIDENTOpenAI: Degraded performance in ChatGPT, Codex, and APIsOpenAIVendor2026-10-21 02:26 UTCby status page–WHAT TO DO HIGH8.8Duplicator WordPress plugins: unauthenticated PHP object injection leads to command executionDuplicatorPackage2026-10-21 02:17 UTCby InfraStack Analyst–FIX 5.0.0 CRITICAL10.0Tenda AC19 router: remote stack overflow in web firewall settingTenda AC19Infrastructure2026-10-21 02:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5Tenstorrent tt-metal: path traversal in checkpoint loader lets attackers read filesPackage2026-10-21 02:17 UTCby EPSS–WHAT TO DO HIGHCAMPAIGNEXPLOITEDOperation FlashHoleLazarus (Operation FlashHole) abuses South Korea's mandatory INISAFE CrossWeb EX banking security software to run in-memory malware controlled through GitHub issuesINISAFE CrossWeb EXVendor2026-10-21 02:07 UTCby InfraStack Analyst–WHAT TO DO HIGH8.7FLARE floss: crafted workspace file runs code on analyst's machinePackage2026-10-21 01:17 UTCby EPSS–WHAT TO DO HIGH8.7capa: crafted workspace file runs code during deserializationcapaPackage2026-10-21 01:17 UTCby InfraStack Analyst–FIX 10.0.0 CRITICAL9.8Bp Premier: hardcoded SQL Server admin password lets attackers run OS commandsBp PremierVendor2026-10-21 01:17 UTCby InfraStack Analyst–FIX 1.14.1.1128 MEDIUM6.3Vyper: blueprint deploy lets bad offset create empty contracts, trapping fundsPackage2026-10-06 08:45 UTCby EPSS–WHAT TO DO HIGH8.2Vyper: optimizer miscompiles msg.value expressions, corrupting contract state and fundsPackage2026-10-02 17:27 UTCby EPSS–WHAT TO DO MEDIUM6.0Vyper: line-break characters let attackers silently change contract constantsPackage2026-10-06 09:04 UTCby EPSS–WHAT TO DO MEDIUM6.3Vyper: compiler miscompiles ternary over nested arrays, corrupting stored valuesPackage2026-10-05 17:04 UTCby EPSS–WHAT TO DO MEDIUM6.0Vyper compiler: multi-byte characters can silently alter compiled numeric constantsPackage2026-10-06 09:28 UTCby EPSS–WHAT TO DO HIGH8.4Sharp: bundled libvips flaws let crafted GIF, TIFF or VIPS files attackPackage2026-07-17 10:48 UTCby EPSS–WHAT TO DO HIGH8.9Sharp: bundled libheif flaw lets crafted images run code on glibc LinuxPackage2026-08-27 09:33 UTCby EPSS–WHAT TO DO HIGH8.9sharp: bundled librsvg flaw lets a crafted SVG run code on glibc LinuxPackage2026-09-30 19:22 UTCby EPSS–WHAT TO DO HIGH8.8uv: malicious wheel entry point names escape scripts directoryPackage2026-05-18 20:07 UTCby EPSS–WHAT TO DO CRITICAL9.8Vibe-Trading: missing auth lets anyone run shell commands on the serverAI agents & MCP2026-07-29 12:13 UTCby EPSS–WHAT TO DO HIGH8.8Vibe-Trading agent: planted web or document text runs root shell commandsvibe-trading-aiAI agents & MCP2026-07-29 12:07 UTCby InfraStack Analyst–FIX 0.1.7 HIGH8.7Vibe-Trading: path traversal lets AI agent read server secretsAI agents & MCP2026-07-29 12:07 UTCby EPSS–WHAT TO DO MEDIUM6.9adm-zip: crafted zip archives can set setuid bits on extracted filesPackage2026-09-11 13:22 UTCby EPSS–WHAT TO DO HIGH8.2adm-zip: duplicate ZIP entry names bypass content validation before extractionPackage2026-09-11 13:23 UTCby EPSS–WHAT TO DO MEDIUM6.9adm-zip: async extraction skips decompression bomb guard, exhausting memoryPackage2026-09-11 13:20 UTCby EPSS–WHAT TO DO HIGH8.7adm-zip: malformed ZIP crashes Node.js process via missing error listenerPackage2026-09-11 13:19 UTCby EPSS–WHAT TO DO MEDIUM6.3Coraza WAF: multipart filename parsing lets uploads bypass file rulesPackage2026-10-02 13:55 UTCby EPSS–WHAT TO DO MEDIUM6.9Coraza WAF: URL-encoded bodies with charset parameter skip inspectionPackage2026-10-02 13:55 UTCby EPSS–WHAT TO DO MEDIUM6.9Coraza WAF: JSON body flattening lets crafted keys hide SQL injectionPackage2026-10-02 13:55 UTCby EPSS–WHAT TO DO HIGH7.8Dulwich: stash pop path traversal writes files and runs code on checkoutPackage2026-07-06 00:47 UTCby EPSS–WHAT TO DO HIGH7.8Dulwich: symlink path traversal in filter_branch lets attackers write filesPackage2026-07-06 00:48 UTCby EPSS–WHAT TO DO HIGH7.8Dulwich: symlink following in checkout lets crafted repos plant hooksPackage2026-07-06 01:09 UTCby EPSS–WHAT TO DO HIGH7.1Dulwich: crafted packfile causes infinite recursion and CPU exhaustionPackage2026-07-06 10:57 UTCby EPSS–WHAT TO DO HIGH8.8Dulwich: Windows drive-letter tree entries let a repo write files outside worktreePackage2026-07-06 11:00 UTCby EPSS–WHAT TO DO MEDIUM5.3Trigger.dev: GET logout endpoint lets a link sign users outPackage2026-07-21 12:42 UTCby EPSS–WHAT TO DO HIGH8.3Trigger.dev: unauthenticated run replay leaks payloads and reruns tasksPackage2026-07-09 14:01 UTCby EPSS–WHAT TO DO MEDIUM6.0Trigger.dev: run replay route leaks other tenants' task payloadsPackage2026-07-09 14:01 UTCby EPSS–WHAT TO DO HIGH7.6Trigger.dev CLI: MCP server exposes unauthenticated task control to the networkAI agents & MCP2026-07-21 11:40 UTCby EPSS–WHAT TO DO HIGH8.8Trigger.dev: CSRF in CLI login flow lets attackers steal access tokenstrigger.devPackage2026-07-09 14:16 UTCby InfraStack Analyst–FIX 4.5.2 HIGH8.3Trigger.dev: hardcoded coordinator secret lets outsiders read run environment variablesPackage2026-07-20 16:45 UTCby EPSS–WHAT TO DO CRITICAL9.2Trigger.dev: default Docker secrets let anyone log in as any userPackage2026-07-21 11:46 UTCby EPSS–WHAT TO DO MEDIUM6.9Trigger.dev: unauthenticated POST injects data into run realtime streamsPackage2026-07-21 11:53 UTCby EPSS–WHAT TO DO HIGH8.8Trigger.dev: workload server flaw lets tenants hijack other tenants' runstrigger.devPackage2026-09-14 14:58 UTCby InfraStack Analyst–WHAT TO DO HIGH8.3Trigger.dev: SQL injection in runs endpoint leaks other tenants' task dataPackage2026-07-21 11:57 UTCby EPSS–WHAT TO DO HIGH8.6Trigger.dev: path traversal lets one tenant read or overwrite others' payloadstrigger.devPackage2026-07-09 14:18 UTCby InfraStack Analyst–FIX 4.5.0-rc.3 HIGH8.1Trigger.dev: session input flaw leaks stream credentials, allowing forged or deleted streamsPackage2026-07-21 12:43 UTCby EPSS–WHAT TO DO HIGH8.3Trigger.dev: SQL injection in query compiler exposes other tenants' dataPackage2026-07-21 12:44 UTCby EPSS–WHAT TO DO MEDIUM5.3Trigger.dev: alert webhooks let project members reach internal addressesRuntime2026-07-09 18:44 UTCby EPSS–WHAT TO DO MEDIUM5.4Trigger.dev: low-trust API keys can cancel production deploymentsPackage2026-07-21 12:48 UTCby EPSS–WHAT TO DO HIGH8.1Trigger.dev: authenticated users can delete other organizations' cron schedulesPackage2026-07-21 12:47 UTCby EPSS–WHAT TO DO HIGH7.1Trigger.dev: deployment lookup by ID lets one environment hijack another's deploymentPackage2026-07-21 12:49 UTCby EPSS–WHAT TO DO MEDIUM5.4Trigger.dev: webhook alert URL lets tenants reach internal hostsPackage2026-07-09 19:12 UTCby EPSS–WHAT TO DO MEDIUM5.4Trigger.dev: read-only user tokens can create production alert webhooksPackage2026-08-20 11:57 UTCby EPSS–WHAT TO DO MEDIUM5.4Trigger.dev: webhook SSRF lets project members reach internal 198.18.0.0/15 servicesPackage2026-08-07 20:09 UTCby EPSS–WHAT TO DO MEDIUM6.8Trigger.dev CLI: debug logs leak resolved environment secrets to readersPackage2026-07-31 14:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Trigger.dev: Slack OAuth flow lets attackers link their own workspaceVendor2026-08-20 12:24 UTCby EPSS–WHAT TO DO LOW3.1Trigger.dev: authorization bypass lets members complete others' dev waitpointsPackage2026-09-08 15:36 UTCby EPSS–WHAT TO DO MEDIUM5.1Trigger.dev: dashboard agent proxy leaks user actor token to session readersPackage2026-09-14 14:54 UTCby EPSS–WHAT TO DO HIGH8.6Trigger.dev: read-only key can leak root secret key and env varstrigger.devPackage2026-09-14 14:52 UTCby InfraStack Analyst–FIX 4.6.0 HIGH8.3Trigger.dev: waitpoint endpoint lets any API key block other organizations' runsPackage2026-09-14 14:51 UTCby EPSS–WHAT TO DO HIGH7.1Trigger.dev: public session token lets users overwrite chat history snapshotsPackage2026-09-16 12:03 UTCby EPSS–WHAT TO DO HIGH8.1Trigger.dev: API key holders can block other organizations' runsPackage2026-10-02 04:29 UTCby EPSS–WHAT TO DO HIGH7.1Trigger.dev: authenticated users can read other tenants' run dataRuntime2026-10-06 13:40 UTCby EPSS–WHAT TO DO MEDIUM5.5Snipe-IT: webhook test feature lets super-admins probe internal network hostsOther2026-10-06 16:00 UTCby EPSS–WHAT TO DO HIGH8.7SvelteKit on Windows: preview server path traversal exposes server filesPackage2026-10-05 19:33 UTCby EPSS–WHAT TO DO MEDIUM6.9SvelteKit: self-fetch fallbacks follow redirects, enabling server-side request forgeryRuntime2026-10-05 19:34 UTCby EPSS–WHAT TO DO MEDIUM4.7SvelteKit : XSS via untrusted cache-control header in prerendered page@sveltejs/kitPackage2026-10-05 19:35 UTCby GitHub Advisories–FIX 3.0.0 MEDIUM4.7SvelteKit: URL redirection to untrusted site via enhanced form submission@sveltejs/kitRuntime2026-10-05 19:35 UTCby GitHub Advisories–FIX 3.0.0 HIGH7.7ArcadeDB: read-only users can run Groovy code on the serverPackage2026-10-05 20:05 UTCby EPSS–WHAT TO DO MEDIUM5.3ArcadeDB: Bolt handler lets logged-in users read other databases' schemaPackage2026-10-05 20:05 UTCby EPSS–WHAT TO DO MEDIUM5.3ArcadeDB: Bolt handler lets any logged-in user list all database namesPackage2026-10-05 20:05 UTCby EPSS–WHAT TO DO MEDIUM5.3ArcadeDB: read-only users can alter edge type schema flagsPackage2026-10-05 20:05 UTCby EPSS–WHAT TO DO HIGH8.7vLLM : DoS via unvalidated mm_processor_kwargs in multimodal image processors (Isaac, InternVL, H2OVL, etc.)vllmAI agents & MCP2026-10-06 07:04 UTCby GitHub Advisories–FIX 0.31.0 HIGH7.1vLLM: cache key collisions let authenticated users read other requests' mediaAI agents & MCP2026-10-06 07:08 UTCby EPSS–WHAT TO DO CRITICAL9.2vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code executionvllmAI agents & MCP2026-10-06 07:06 UTCby EPSS–FIX 0.31.0 HIGH8.7vLLM: unbounded processor cache lets unauthenticated requests exhaust memoryAI agents & MCP2026-10-06 06:59 UTCby EPSS–WHAT TO DO HIGH7.5vLLM: one malformed request halts all generation until restartAI agents & MCP2026-10-06 06:58 UTCby EPSS–WHAT TO DO HIGH7.5vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM enginevllmAI agents & MCP2026-10-06 07:10 UTCby GitHub Advisories–FIX 0.31.0 MEDIUM6.3vLLM: stale token allowlists leak between concurrent requests, constraining other users' outputsAI agents & MCP2026-10-06 20:45 UTCby EPSS–WHAT TO DO MEDIUM5.1AVideo: legacy endpoints let forged requests change playlist visibilityPackage2026-10-06 12:14 UTCby EPSS–WHAT TO DO HIGH7.6FreeRDP: proxy accepts untrusted target certificates, enabling interception of sessionsOther2026-10-05 20:28 UTCby EPSS–WHAT TO DO HIGH7.1FreeRDP: null reader name in smartcard emulation crashes RDP clientPackage2026-10-05 20:29 UTCby EPSS–WHAT TO DO HIGH8.8FreeRDP: malicious RDP client can overflow server heap via audioPackage2026-10-05 20:32 UTCby EPSS–WHAT TO DO MEDIUM6.9FreeRDP Android client: malicious server can read heap memory out of boundsPackage2026-10-05 20:31 UTCby EPSS–WHAT TO DO HIGH7.1FreeRDP: malicious RDP server leaks heap memory via clipboard PNGPackage2026-10-05 20:32 UTCby EPSS–WHAT TO DO HIGH7.1FreeRDP: malicious RDP server can crash client via use-after-freePackage2026-10-05 20:30 UTCby EPSS–WHAT TO DO MEDIUM6.9FreeRDP on Windows: malicious gateway triggers heap over-read, leaks memoryPackage2026-10-05 20:29 UTCby EPSS–WHAT TO DO MEDIUM5.1device-mapper-multipath: trailing percent in command leaks daemon memoryInfrastructure2026-10-21 01:17 UTCby EPSS–WHAT TO DO MEDIUM5.0Online Cake Ordering System: reflected cross-site scripting via the useruid parameterOther2026-10-21 01:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Online Cake Ordering System: SQL injection in deletecustomer.php via IDOther2026-10-21 01:17 UTCby EPSS–WHAT TO DO HIGH7.5Jackrong llm-finetuning-guide: path traversal in MTP weight loader scriptOther2026-10-21 01:17 UTCby EPSS–WHAT TO DO MEDIUM6.5Jackrong llm-finetuning-guide: path traversal via weight_map in GGUF pipeline scriptAI agents & MCP2026-10-21 01:17 UTCby EPSS–WHAT TO DO CRITICAL10.0D-Link DHP-W610AV router: HNAP login leaves password empty, remote accessDHP-W610AVInfrastructure2026-10-21 01:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.5Qingteng host security platform: admin can run OS commands on clientsInfrastructure2026-10-21 01:17 UTCby EPSS–WHAT TO DO HIGH8.7uv: malicious sdist writes files outside install directory via symlinksPackage2025-09-23 19:51 UTCby EPSS–WHAT TO DO HIGH8.3Vyper: stack pointer bug corrupts memory during internal calls in arraysPackage2021-04-16 15:55 UTCby EPSS–WHAT TO DO MEDIUM6.3Vyper: forwarder proxies misreport return size, corrupting large call resultsPackage2021-04-16 12:57 UTCby EPSS–WHAT TO DO HIGH8.3Vyper: reentrancy lock storage slots overwrite contract state variablesPackage2021-07-27 16:48 UTCby EPSS–WHAT TO DO MEDIUM6.3Vyper: uint8 return values from interfaces skip bounds checksPackage2020-03-09 15:11 UTCby EPSS–WHAT TO DO MEDIUM6.3Vyper: return inside a for loop breaks internal calls, enabling contract denial of servicePackage2020-07-16 22:36 UTCby EPSS–WHAT TO DO HIGH8.2Vyper: call stack corruption garbles arrays and structs passed to functionsPackage2020-10-10 20:33 UTCby EPSS–WHAT TO DO HIGH8.3Vyper compiler: stack pointer bug corrupts memory in nested internal callsPackage2020-10-10 20:36 UTCby EPSS–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Delays from Twilio to T-Mobile Czech RepublicTwilioVendor2026-10-21 01:10 UTCby status page–WHAT TO DO NOT SCOREDNOT SCOREDDistrust compromised intermediate certificates in crypto/x509stdlibRuntime2026-10-21 00:27 UTCby EPSS–FIX 1.26.10 LOW3.7D-Link DCS-6501LH camera: mydlink root password setter uses weak credentialsInfrastructure2026-10-21 00:17 UTCby EPSS–WHAT TO DO MEDIUM5.5a2a-rs agent server: race condition in in-memory task store updatesAI agents & MCP2026-10-21 00:17 UTCby EPSS–WHAT TO DO MEDIUM5.1a2a-rs: historyLength argument leaks information in in-memory task storePackage2026-10-21 00:17 UTCby EPSS–WHAT TO DO MEDIUM4.7Metasploit Framework: HTTP redirects can reach internal hosts through the operator's machinePackage2026-10-21 00:17 UTCby EPSS–WHAT TO DO MEDIUM4.7FTP client trusts server PASV reply, can open connections to arbitrary hostsOther2026-10-21 00:17 UTCby EPSS–WHAT TO DO HIGHNOT SCOREDCVE-2026-112408 - Missing bucket ownership verification in Amazon SageMaker Python SDK default_bucket()Package2026-10-21by Vendor & lab pages–WHAT TO DO CRITICAL9.8EXPLOITEDphp2shellPHP2ShellPHP: out-of-memory handling flaw lets a web request run codephp79 talkingRuntime2026-10-20 18:35 UTCby InfraStack Analyst79talkingFIX 8.2.35 CRITICAL9.2EXPLOITEDPHP2Shellphp2shellPHP: stale request-memory state lets a later request run codephp65 talkingRuntime2026-10-20 18:35 UTCby InfraStack Analyst65talkingFIX 8.2.35 CRITICALCAMPAIGNEXPLOITEDlitellm 1.107.0 compromiselitellm 1.107.0 on PyPI and Docker shipped a credential stealer and remote code loaderlitellm2 talkingPackage2026-10-21by InfraStack Analyst2talkingWHAT TO DO CRITICAL9.4Amazon SageMaker Python SDK: unowned S3 bucket lets attackers run codePackage2026-10-21by EPSS–WHAT TO DO

Tuesday, Oct 20Wednesday, Oct 21Thursday, Oct 22