Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2020-27619 | 9.8 critical | 8.0% | python, fedoraproject, fedora, communications_cloud_native_core_network_function_cloud_native_environment | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. | 8 Oct |
| CVE-2020-35491 | 8.1 high | 8.0% | fasterxml, netapp, jackson-databind, service_level_manager, debian_linux | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.SharedPoolDataSource. | 8 Oct |
| CVE-2020-7595 | 7.5 high | 8.0% | xmlsoft, fedoraproject, libxml2, fedora, ubuntu_linux | xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation. | 14 Oct |
| CVE-2021-29921 | 9.8 critical | 7.0% | python, oracle, communications_cloud_native_core_automated_test_suite, communications_cloud_native_core_binding_support_function | In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situations) allows attackers to bypass access control that is based on IP addresses. | 8 Oct |
| CVE-2021-37137 | 7.5 high | 7.0% | netty, oracle, banking_apis, banking_digital_experience | The Snappy frame decoder function doesn't restrict the chunk length which may lead to excessive memory usage. Beside this it also may buffer reserved skippable chunks until the whole chunk was received which may lead to excessive memory usage as well. This vulnerability can be triggered by supplying malicious input that decompresses to a very big size (via a network stream or a file) or by sending a huge skippable chunk. | 8 Oct |
| CVE-2022-21123 | 5.5 medium | 7.0% | xen, fedoraproject, fedora, sgx_dcap | Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access. | 14 Oct |
| CVE-2020-28500 | 5.3 medium | 7.0% | lodash, oracle, banking_corporate_lending_process_management, banking_credit_facilities_process_management | Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions. | 8 Oct |
| CVE-2019-16942 | 9.8 critical | 6.0% | fasterxml, debian, jackson-databind, debian_linux, fedora | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling. | 8 Oct |
| CVE-2026-44194 | 9.1 critical | 6.0% | opnsense | OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.8, an authenticated Remote Code Execution (RCE) vulnerability in the OPNsense core allows a user with user-management privileges to execute arbitrary system commands as root. An attacker can bypass input validation by formatting their malicious payload as a compliant email address, allowing shell commands to reach the underlying operating system. The flaw exists in the local user synchronization flow, within core/src/opnsense/scripts/auth/sync_user.php. This vulnerability is fixed in 26.1.8. | Mon 26 Oct |
| CVE-2020-35490 | 8.1 high | 6.0% | fasterxml, netapp, jackson-databind, service_level_manager, debian_linux | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.dbcp2.datasources.PerUserPoolDataSource. | 8 Oct |
| CVE-2021-37136 | 7.5 high | 6.0% | netty, quarkus, banking_apis | The Bzip2 decompression decoder function doesn't allow setting size restrictions on the decompressed output data (which affects the allocation size used during decompression). All users of Bzip2Decoder are affected. The malicious input can trigger an OOME and so a DoS attack | 8 Oct |
| CVE-2016-0706 | 4.3 medium | 6.0% | canonical, debian, ubuntu_linux, debian_linux, tomcat | Apache Tomcat 6.x before 6.0.45, 7.x before 7.0.68, 8.x before 8.0.31, and 9.x before 9.0.0.M2 does not place org.apache.catalina.manager.StatusManagerServlet on the org/apache/catalina/core/RestrictedServlets.properties list, which allows remote authenticated users to bypass intended SecurityManager restrictions and read arbitrary HTTP requests, and consequently discover session ID values, via a crafted web application. | 15 Oct |
| CVE-2022-23219 | 9.8 critical | 5.0% | gnu, oracle, glibc, communications_cloud_native_core_binding_support_function, communications_cloud_native_core_network_function_cloud_native_environment | The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution. | 14 Oct |
| CVE-2022-23218 | 9.8 critical | 5.0% | gnu, oracle, glibc, communications_cloud_native_core_unified_data_repository, enterprise_operations_monitor | The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or (if an application is not built with a stack protector enabled) arbitrary code execution. | 14 Oct |
| CVE-2019-17531 | 9.8 critical | 5.0% | fasterxml, debian, jackson-databind, debian_linux, jboss_enterprise_application_platform | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload. | 8 Oct |
| CVE-2020-36183 | 8.1 high | 5.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.docx4j.org.apache.xalan.lib.sql.JNDIConnectionPool. | 8 Oct |
| CVE-2022-23308 | 7.5 high | 5.0% | xmlsoft, fedoraproject, libxml2, fedora, debian_linux | valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. | 14 Oct |
| CVE-2021-22946 | 7.5 high | 5.0% | haxx, debian, curl, debian_linux, fedora | A user can tell curl >= 7.20.0 and <= 7.78.0 to require a successful upgrade to TLS when speaking to an IMAP, POP3 or FTP server (`--ssl-reqd` on the command line or`CURLOPT_USE_SSL` set to `CURLUSESSL_CONTROL` or `CURLUSESSL_ALL` withlibcurl). This requirement could be bypassed if the server would return a properly crafted but perfectly legitimate response.This flaw would then make curl silently continue its operations **withoutTLS** contrary to the instructions and expectations, exposing possibly sensitive data in clear text over the network. | 14 Oct |
| CVE-2020-8286 | 7.5 high | 5.0% | haxx, fedoraproject, libcurl, fedora, debian_linux | curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response. | 14 Oct |
| CVE-2020-8231 | 7.5 high | 5.0% | haxx, siemens, libcurl, sinec_infrastructure_network_services, debian_linux | Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data. | 14 Oct |
| CVE-2021-21409 | 5.9 medium | 5.0% | netty, debian, debian_linux, oncommand_api_services | Netty is an open-source, asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. In Netty (io.netty:netty-codec-http2) before version 4.1.61.Final there is a vulnerability that enables request smuggling. The content-length header is not correctly validated if the request only uses a single Http2HeaderFrame with the endStream set to to true. This could lead to request smuggling if the request is proxied to a remote peer and translated to HTTP/1.1. This is a followup of GHSA-wm47-8v5p-wjpj/CVE-2021-21295 which did miss to fix this one case. This was fixed as part of 4.1.61.Final. | 8 Oct |
| CVE-2025-34301 | 5.1 medium | 5.0% | ipfire | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code into the COUNTRY_CODE parameter when creating a location group. When a user adds a new location group, the application issues an HTTP POST request with the ACTION parameter set to savelocationgrp, and the value of the COUNTRY_CODE parameter determines the flag displayed for that group. The value of this parameter is stored and later rendered in the web interface without proper sanitization or encoding, allowing malicious scripts to be executed in the context of other users viewing the affected page. | 19 Oct |
| CVE-2025-34309 | 5.1 medium | 5.0% | ipfire | IPFire versions prior to 2.29 (Core Update 198) contain a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject arbitrary JavaScript code through the SERVICE, LOGIN, and PASSWORD parameters when creating or editing a Dynamic DNS host. When a new Dynamic DNS host is added, the application issues an HTTP POST request to /cgi-bin/ddns.cgi and saves the values of the LOGIN, PASSWORD, and SERVICE parameters. The SERVICE value is displayed after the host entry is created, and the LOGIN and PASSWORD values are displayed when that host entry is edited. The values of these parameters are stored and later rendered in the web interface without proper sanitation or encoding, allowing injected scripts to execute in the context of other users who view or edit the affected Dynamic DNS entries. | 19 Oct |
| CVE-2021-22898 | 3.1 low | 5.0% | haxx, debian, curl, debian_linux, fedora | curl 7.7 through 7.76.1 suffers from an information disclosure when the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl, is used to send variable=content pairs to TELNET servers. Due to a flaw in the option parser for sending NEW_ENV variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server, resulting in potentially revealing sensitive internal information to the server using a clear-text network protocol. | 14 Oct |
| CVE-2022-24407 | 8.8 high | 4.0% | cyrusimap, debian, cyrus-sasl, debian_linux, fedora | In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement. | 14 Oct |
| CVE-2020-36189 | 8.1 high | 4.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to com.newrelic.agent.deps.ch.qos.logback.core.db.DriverManagerConnectionSource. | 8 Oct |
| CVE-2020-36187 | 8.1 high | 4.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.SharedPoolDataSource. | 8 Oct |
| CVE-2020-36186 | 8.1 high | 4.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp.datasources.PerUserPoolDataSource. | 8 Oct |
| CVE-2020-36185 | 8.1 high | 4.0% | fasterxml, netapp, jackson-databind, cloud_backup, service_level_manager | FasterXML jackson-databind 2.x before 2.9.10.8 mishandles the interaction between serialization gadgets and typing, related to org.apache.tomcat.dbcp.dbcp2.datasources.SharedPoolDataSource. | 8 Oct |
| CVE-2026-50509 | 7.8 high | 4.0% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally. | Wed 28 Oct |
| CVE-2021-38604 | 7.5 high | 4.0% | gnu, fedoraproject, glibc, fedora, communications_cloud_native_core_binding_support_function | In librt in the GNU C Library (aka glibc) through 2.34, sysdeps/unix/sysv/linux/mq_notify.c mishandles certain NOTIFY_REMOVED data, leading to a NULL pointer dereference. NOTE: this vulnerability was introduced as a side effect of the CVE-2021-33574 fix. | 14 Oct |
| CVE-2021-3326 | 7.5 high | 4.0% | gnu, netapp, glibc, e-series_santricity_os_controller, ontap_select_deploy_administration_utility | The iconv function in the GNU C Library (aka glibc or libc6) 2.32 and earlier, when processing invalid input sequences in the ISO-2022-JP-3 encoding, fails an assertion in the code path and aborts the program, potentially resulting in a denial of service. | 14 Oct |
| CVE-2020-29363 | 7.5 high | 4.0% | p11-kit_project, debian, p11-kit, debian_linux, communications_cloud_native_core_policy | An issue was discovered in p11-kit 0.23.6 through 0.23.21. A heap-based buffer overflow has been discovered in the RPC protocol used by p11-kit server/remote commands and the client library. When the remote entity supplies a serialized byte array in a CK_ATTRIBUTE, the receiving entity may not allocate sufficient length for the buffer to store the deserialized value. | 14 Oct |
| CVE-2020-28196 | 7.5 high | 4.0% | mit, fedoraproject, kerberos_5, fedora, active_iq_unified_manager | MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit. | 14 Oct |
| CVE-2021-3807 | 7.5 high | 4.0% | ansi-regex_project, oracle, ansi-regex, communications_cloud_native_core_policy | ansi-regex is vulnerable to Inefficient Regular Expression Complexity | 8 Oct |
| CVE-2021-3537 | 5.9 medium | 4.0% | xmlsoft, redhat, libxml2, jboss_core_services, enterprise_linux | A vulnerability found in libxml2 in versions before 2.9.11 shows that it did not propagate errors while parsing XML mixed content, causing a NULL dereference. If an untrusted XML document was parsed in recovery mode and post-validated, the flaw could be used to crash the application. The highest threat from this vulnerability is to system availability. | 14 Oct |
| CVE-2021-22897 | 5.3 medium | 4.0% | haxx, oracle, curl, communications_cloud_native_core_binding_support_function, communications_cloud_native_core_network_function_cloud_native_environment | curl 7.61.0 through 7.76.1 suffers from exposure of data element to wrong session due to a mistake in the code for CURLOPT_SSL_CIPHER_LIST when libcurl is built to use the Schannel TLS library. The selected cipher set was stored in a single "static" variable in the library, which has the surprising side-effect that if an application sets up multiple concurrent transfers, the last one that sets the ciphers will accidentally control the set used by all transfers. In a worst-case scenario, this weakens transport security significantly. | 14 Oct |
| CVE-2020-14155 | 5.3 medium | 4.0% | pcre, apple, macos, gitlab | libpcre in PCRE before 8.44 allows an integer overflow via a large number after a (?C substring. | 8 Oct |
| CVE-2020-8284 | 3.7 low | 4.0% | haxx, fedoraproject, curl, fedora, debian_linux | A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. | 14 Oct |
| CVE-2021-3520 | 9.8 critical | 3.0% | lz4_project, netapp, lz4, active_iq_unified_manager, cloud_backup | There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, leading to calling of memmove() on a negative size argument, causing an out-of-bounds write and/or a crash. The greatest impact of this flaw is to availability, with some potential impact to confidentiality and integrity as well. | 14 Oct |
| CVE-2021-43396 | 7.5 high | 3.0% | gnu, oracle, glibc, communications_cloud_native_core_binding_support_function, communications_cloud_native_core_network_function_cloud_native_environment | In iconvdata/iso-2022-jp-3.c in the GNU C Library (aka glibc) 2.34, remote attackers can force iconv() to emit a spurious '\0' character via crafted ISO-2022-JP-3 data that is accompanied by an internal state reset. This may affect data integrity in certain iconv() use cases. NOTE: the vendor states "the bug cannot be invoked through user input and requires iconv to be invoked with a NULL inbuf, which ought to require a separate application bug to do so unintentionally. Hence there's no security impact to the bug. | 14 Oct |
| CVE-2020-25710 | 7.5 high | 3.0% | openldap, redhat, jboss_core_services, jboss_enterprise_application_platform | A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability. | 14 Oct |
| CVE-2020-25709 | 7.5 high | 3.0% | openldap, debian, debian_linux, mac_os_x | A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability. | 14 Oct |
| CVE-2019-20388 | 7.5 high | 3.0% | xmlsoft, debian, libxml2, debian_linux, cloud_backup | xmlSchemaPreRun in xmlschemas.c in libxml2 2.9.10 allows an xmlSchemaValidateStream memory leak. | 14 Oct |
| CVE-2021-37750 | 6.5 medium | 3.0% | mit, fedoraproject, kerberos_5, fedora, debian_linux | The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field. | 14 Oct |
| CVE-2020-24977 | 6.5 medium | 3.0% | xmlsoft, debian, libxml2, debian_linux, fedora | GNOME project libxml2 v2.9.10 has a global buffer over-read vulnerability in xmlEncodeEntitiesInternal at libxml2/entities.c. The issue has been fixed in commit 50f06b3e. | 14 Oct |
| CVE-2021-43797 | 6.5 medium | 3.0% | netty, quarkus, oncommand_workflow_automation | Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clients. Netty prior to version 4.1.71.Final skips control chars when they are present at the beginning / end of the header name. It should instead fail fast as these are not allowed by the spec and could lead to HTTP request smuggling. Failing to do the validation might cause netty to "sanitize" header names before it forward these to another remote system when used as proxy. This remote system can't see the invalid usage anymore, and therefore does not do the validation itself. Users should upgrade to version 4.1.71.Final. | 8 Oct |
| CVE-2021-22947 | 5.9 medium | 3.0% | haxx, fedoraproject, curl, fedora, debian_linux | When curl >= 7.20.0 and <= 7.78.0 connects to an IMAP or POP3 server to retrieve data using STARTTLS to upgrade to TLS security, the server can respond and send back multiple responses at once that curl caches. curl would then upgrade to TLS but not flush the in-queue of cached responses but instead continue using and trustingthe responses it got *before* the TLS handshake as if they were authenticated.Using this flaw, it allows a Man-In-The-Middle attacker to first inject the fake responses, then pass-through the TLS traffic from the legitimate server and trick curl into sending data back to the user thinking the attacker's injected data comes from the TLS-protected server. | 14 Oct |
| CVE-2026-33264 | 9.8 critical | 2.0% | apache, airflow | A bug in `BaseSerialization.deserialize()` allowed unrestricted `import_string()` of attacker-controlled class paths when the Scheduler / API Server loaded a serialized DAG: a DAG author could embed a malicious trigger into a DAG to gain remote code execution on the API Server / Scheduler process, crossing the Airflow security boundary that DAG-author code must never execute in those processes. Users are advised to upgrade to `apache-airflow` 3.3.0 or later. As a defense-in-depth mitigation, deployments where DAG-author trust is limited can restrict the `[core] allowed_deserialization_classes` config to a narrow allowlist. | Sun 25 Oct |
| CVE-2020-36856 | 9.4 critical | 2.0% | nagios, nagios_xi | Nagios XI versions prior to 5.6.14 contain an authenticated remote command execution vulnerability in the CCM command_test.php script. Insufficient validation of the `address` parameter allows an authenticated user with access to the Core Config Manager to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitation enables arbitrary command execution with the privileges of the Nagios XI web application user and may be leveraged to execute commands on the underlying XI host, modify system configuration, or fully compromise the host. | 18 Oct |
Download these 1000 as CSV (the first thousand in this order) · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.