Vulnerability intelligence / live index
A working index of published vulnerability records, ordered by latest update. Open a record to inspect its score, vector, and impact metrics.
CVE Program / CVE List®
Updated continuously
Oct 31, 2026 UTC
XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoder. Affected versions compile a bundled brotli into static archives that dependent XS modules link against at build time, rather than using the system library. The bund…
Inspect record →Oct 31, 2026 UTC
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.
Inspect record →Oct 31, 2026 UTC
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Inspect record →Oct 31, 2026 UTC
A security flaw has been discovered in ken678 YznCMS up to 2.2.0. The affected element is the function Backend of the file app/admin/controller/auth/Group.php of the component Auth Group Handler. Performing a manipulation results in improper privilege management. The attack can b…
Inspect record →Oct 31, 2026 UTC
Uncontrolled Recursion vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.
Inspect record →Oct 31, 2026 UTC
**UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inacti…
Inspect record →Oct 31, 2026 UTC
In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket (newinet->inet_opt) without copying it. Another cpu can concurrently …
Inspect record →Oct 31, 2026 UTC
Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Inspect record →Oct 31, 2026 UTC
This issue affects Apache SIS from version 0.7 through 1.6 inclusive. When a data file contains links to other files, Apache SIS opened these files regardless their paths. It was possible, for example, to specify a path to a local file. However, these files were always expected t…
Inspect record →Oct 31, 2026 UTC
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
Inspect record →Oct 31, 2026 UTC
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
Inspect record →Oct 31, 2026 UTC
Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
Inspect record →Oct 31, 2026 UTC
Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Inspect record →Oct 31, 2026 UTC
Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.
Inspect record →Oct 31, 2026 UTC
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
Inspect record →
