Public CVE feed
Public CVE records, affected versions and known exploitation, with sources you can verify.
Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller
jboss-marshalling-river · eap7-activemq-artemis · eap7-glassfish-jsf
Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery
undertow-core · eap7-activemq-artemis · eap7-glassfish-jsf
Picketlink-federation: auth bypass in picketlink saml unsolicited-response
Red Hat JBoss Enterprise Application Platform 7.4.25 · eap7-activemq-artemis · eap7-glassfish-jsf
ESX insufficient logging vulnerability
Cloud Foundation · vSphere Foundation · ESX
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Adobe Commerce · Adobe Commerce B2B · Magento Open Source
Quadratic complexity in WordDecoder.DecodeHeader in mime
mime
net: skbuff: preserve shared-frag marker during coalescing
Linux
Apache Thrift: Node.js skip() recursion
Apache Thrift
Libsoup: integer underflow in soup_multipart_new_from_message() leading to denial of service in libsoup
libsoup · libsoup3
Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value
libsoup · mingw-freetype · spice-client-win
Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process
libsoup · libsoup3
Libsoup: out of bounds reads in soup_headers_parse_request()
libsoup · libsoup3 · mingw-freetype
Libsoup: null pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no value in content-disposition header
libsoup · mingw-freetype · spice-client-win
Libsoup: denial of service attack to websocket server
libsoup · libsoup3
Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content
libsoup · libsoup3
Xz: malicious code in distributed source
xz
Sources: official CVE Program records and CISA KEV. The catalogue starts with recently changed records and selected exploited CVEs, and grows through exact-ID lookups. It is not a complete copy of the CVE List. Updates are attempted hourly.