Vulnerability Database
Real-time vulnerability intelligence from the European Union Vulnerability Database (EUVD).
Real-time access to the European Union Vulnerability Database (EUVD), maintained by ENISA. Search and monitor CVEs (Common Vulnerabilities and Exposures), exploited vulnerabilities, and critical security flaws affecting software products worldwide.
- Latest: Most recently disclosed vulnerabilities across all software vendors and products.
- Exploited: Vulnerabilities confirmed to be actively exploited in the wild — prioritize patching these immediately.
- Critical: CRITICAL severity vulnerabilities (CVSS 9.0+) requiring urgent attention from security teams.
- Search: Search by product name, vendor, CVSS score range, or exploitation status to find vulnerabilities affecting your environment.
Each vulnerability includes CVSS scoring, EPSS exploitation probability, affected vendors and products, references to advisories, and CVE aliases. Click any vulnerability to expand full details and references.
Dify is an open-source LLM app development platform. Prior to 1.16.0, the PUT /console/api/apps/<app_id>/server endpoint in api/controllers/console/app/mcp_server.py used AppMCPServerController.put() to retrieve an AppMCPServer by the client-supplied server ID without verifying that the server belonged to the requested application and tenant. An authenticated workspace member could therefore change another application's MCP server status and parameters, potentially redirecting data or disabling the service. This issue is fixed in version 1.16.0.
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field to select the GLMGA video backend and supply large values for the fps and max_frames options without a strict work ceiling. GLMGA constructs and deduplicates an attacker-sized pre-decode frame-index list, allowing a compact request and tiny valid video to consume disproportionate CPU time and memory in the shared media-loading executor. This issue is fixed in version 0.30.0.
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching registered routes. An unauthenticated attacker can send unique arbitrary method tokens to unguarded routes such as /tokenize, causing Prometheus's Family::get_or_create function to permanently create counter and histogram label sets. Those label sets increase process memory usage and enlarge the /metrics response until the service or monitoring path is exhausted. This issue is fixed in version 0.30.0.
GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
Snowflake drivers writes sensitive information to logs
vLLM is an inference and serving engine for large language models. From 0.24.0 until 0.30.0, the Qwen2VLVideoBackend and Qwen3VLVideoBackend classes accept request-level values for the media_io_kwargs.video.max_frames and media_io_kwargs.video.fps fields without enforcing server-side ceilings. An unauthenticated caller can submit these values to the /tokenize endpoint, causing the sampler to decode every frame selected from attacker-controlled video input, consume disproportionate frontend memory, and potentially terminate the API process before scheduling or admission control. The Rust frontend is not affected because it rejects the media_io_kwargs field. This issue is fixed in version 0.30.0.
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows