65443+ vulnerabilities with CVSS scores, EPSS exploit predictions, and CISA KEV status. Updated daily.
The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side …
Tanium addressed a SQL injection vulnerability in Provision.
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management …
A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the …
HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierURL before creation, update, testing, and scheduled …
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and …
Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to version 1.37.0, the Vaultwarden icon downloader validates the initial icon host and DNS results but …
Tanium addressed an improper access controls vulnerability in Enforce.
Tanium addressed an uncontrolled resource consumption vulnerability in Enforce.
Tanium addressed a denial of service vulnerability in Enforce.
Tanium addressed a denial of service vulnerability in Enforce.
Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.
Tanium addressed an insertion of sensitive information into log file vulnerability in Threat Response.
Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.
Tanium addressed an insertion of sensitive information into log file vulnerability in Reputation.
Tanium addressed an information disclosure vulnerability in Tanium Server.
Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server.
Tanium addressed a denial of service vulnerability in Tanium Server.
Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.
Tanium addressed a SQL injection vulnerability in Patch.
Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low …
The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though …
When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member of …
A user could create a docx or odt file with a # in the filename with confidential information such as a credit card number and …
App passwords were allowed to bypass password confirmation on sensitive endpoints.
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds …
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated …
Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through json.NewDecoder(io.TeeReader(r.Body, &bodyBuffer)) under …
Substance3D - Painter is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to …
systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStats(ifaces) in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in …
A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parse_reply_call_callback function in libXtst before 1.2.6 to …
A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function load_pretrained_gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic_arch.py of the …
A vulnerability was detected in crownpku Rasa_NLU_Chi up to 0.12.2. Affected is the function Persistor._decompress of the file rasa_nlu/persistor.py of the component Model Persistor. The …
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack …
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification …
A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a …
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions …
Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions …
PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70, LTS2025 release versions 8.3.1.0 through 8.3.1.30, LTS2026 release versions 8.6.1.0 …
Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7.
Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed daily_limit_sat by exploiting …
Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan_vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients …
EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply …
Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments …
MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows authenticated users to modify other users' document share …
rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read stories from unpublished feeds through the anonymous publish.story_get endpoint. Because …
SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in src/IMG_lbm.c that skips bitplane count validation when HAM mode is …
zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint …
Free website and port scanning — find vulnerabilities before attackers do.