| 0 |
| url |
VCID-12uy-cu8u-jkda |
| vulnerability_id |
VCID-12uy-cu8u-jkda |
| summary |
Improper Input Validation in Hibernate Validator
A flaw was found in Hibernate Validator version 6.1.2.Final. A bug in the message interpolation processor enables invalid EL expressions to be evaluated as if they were valid. This flaw allows attackers to bypass input sanitation (escaping, stripping) controls that developers may have put in place when handling user-controlled data in error messages. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-10693 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00094 |
| scoring_system |
epss |
| scoring_elements |
0.2623 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00094 |
| scoring_system |
epss |
| scoring_elements |
0.26224 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.00094 |
| scoring_system |
epss |
| scoring_elements |
0.2628 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.00094 |
| scoring_system |
epss |
| scoring_elements |
0.26228 |
| published_at |
2026-06-04T12:55:00Z |
|
| 4 |
| value |
0.00094 |
| scoring_system |
epss |
| scoring_elements |
0.26324 |
| published_at |
2026-06-06T12:55:00Z |
|
| 5 |
| value |
0.00094 |
| scoring_system |
epss |
| scoring_elements |
0.26332 |
| published_at |
2026-06-05T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-10693 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-10693, GHSA-rmrm-75hp-phr2
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-12uy-cu8u-jkda |
|
| 1 |
| url |
VCID-1vm1-ucy4-3bga |
| vulnerability_id |
VCID-1vm1-ucy4-3bga |
| summary |
foreman: stored XSS in success notification after entity creation |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-16861 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60196 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60242 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60245 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60232 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60215 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60233 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-16861 |
|
| 2 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-16861
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-1vm1-ucy4-3bga |
|
| 2 |
| url |
VCID-2a6m-asyd-8uax |
| vulnerability_id |
VCID-2a6m-asyd-8uax |
| summary |
Exposure of Sensitive Information to an Unauthorized Actor
The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2016-2166 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00271 |
| scoring_system |
epss |
| scoring_elements |
0.50794 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00271 |
| scoring_system |
epss |
| scoring_elements |
0.50765 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.00271 |
| scoring_system |
epss |
| scoring_elements |
0.50825 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.00271 |
| scoring_system |
epss |
| scoring_elements |
0.5083 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.00271 |
| scoring_system |
epss |
| scoring_elements |
0.50809 |
| published_at |
2026-06-07T12:55:00Z |
|
| 5 |
| value |
0.00271 |
| scoring_system |
epss |
| scoring_elements |
0.50778 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2016-2166 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2016-2166, GHSA-f5cf-f7px-xpmh
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2a6m-asyd-8uax |
|
| 3 |
| url |
VCID-2bvt-36z3-9qar |
| vulnerability_id |
VCID-2bvt-36z3-9qar |
| summary |
Potential Denial of Service Vulnerability
Carefully crafted requests can cause a `SystemStackError` and potentially cause a denial of service attack. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2015-3225 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.13251 |
| scoring_system |
epss |
| scoring_elements |
0.94297 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.13251 |
| scoring_system |
epss |
| scoring_elements |
0.94282 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.13251 |
| scoring_system |
epss |
| scoring_elements |
0.9429 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.13251 |
| scoring_system |
epss |
| scoring_elements |
0.94291 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.13251 |
| scoring_system |
epss |
| scoring_elements |
0.94293 |
| published_at |
2026-06-07T12:55:00Z |
|
| 5 |
| value |
0.13251 |
| scoring_system |
epss |
| scoring_elements |
0.94292 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2015-3225 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
|
| fixed_packages |
|
| aliases |
CVE-2015-3225, GHSA-rgr4-9jh5-j4j6
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2bvt-36z3-9qar |
|
| 4 |
| url |
VCID-2fpp-8z24-5qgq |
| vulnerability_id |
VCID-2fpp-8z24-5qgq |
| summary |
candlepin: credentials exposure through log files |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2019-3891 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00042 |
| scoring_system |
epss |
| scoring_elements |
0.13102 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00042 |
| scoring_system |
epss |
| scoring_elements |
0.1318 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00042 |
| scoring_system |
epss |
| scoring_elements |
0.13183 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00042 |
| scoring_system |
epss |
| scoring_elements |
0.13143 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00042 |
| scoring_system |
epss |
| scoring_elements |
0.13072 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00042 |
| scoring_system |
epss |
| scoring_elements |
0.13104 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2019-3891 |
|
| 2 |
|
|
| fixed_packages |
|
| aliases |
CVE-2019-3891
|
| risk_score |
2.5 |
| exploitability |
0.5 |
| weighted_severity |
5.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2fpp-8z24-5qgq |
|
| 5 |
| url |
VCID-2pjq-5np3-buhj |
| vulnerability_id |
VCID-2pjq-5np3-buhj |
| summary |
In Bouncy Castle JCE Provider it is possible to inject extra elements in the sequence making up the signature and still have it validate
In Bouncy Castle JCE Provider version 1.55 and earlier the DSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000338 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00371 |
| scoring_system |
epss |
| scoring_elements |
0.59253 |
| published_at |
2026-06-06T12:55:00Z |
|
| 1 |
| value |
0.00371 |
| scoring_system |
epss |
| scoring_elements |
0.59249 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00371 |
| scoring_system |
epss |
| scoring_elements |
0.59227 |
| published_at |
2026-06-08T12:55:00Z |
|
| 3 |
| value |
0.00371 |
| scoring_system |
epss |
| scoring_elements |
0.59245 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00371 |
| scoring_system |
epss |
| scoring_elements |
0.59243 |
| published_at |
2026-06-09T12:55:00Z |
|
| 5 |
| value |
0.00381 |
| scoring_system |
epss |
| scoring_elements |
0.59848 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000338 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
|
| fixed_packages |
|
| aliases |
CVE-2016-1000338, GHSA-4vhj-98r6-424h
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2pjq-5np3-buhj |
|
| 6 |
| url |
VCID-2tx6-127m-6qf8 |
| vulnerability_id |
VCID-2tx6-127m-6qf8 |
| summary |
Withdrawn Advisory: Improper Restriction of XML External Entity Reference in Apache ActiveMQ
## Withdrawn Advisory
This advisory has been withdrawn because further investgation revealed that this is not a security issue. This link is maintained to preserve external references.
## Original Description
XML external entity (XXE) vulnerability in the XPath selector component in Artemis ActiveMQ before commit 48d9951d879e0c8cbb59d4b64ab59d53ef88310d allows remote attackers to have unspecified impact via unknown vectors. |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2015-3208, GHSA-x6rc-54xp-ccxx
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2tx6-127m-6qf8 |
|
| 7 |
| url |
VCID-2txy-d7e8-2udh |
| vulnerability_id |
VCID-2txy-d7e8-2udh |
| summary |
foreman: Persisted XSS on all pages that use breadcrumbs |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-14664 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00291 |
| scoring_system |
epss |
| scoring_elements |
0.52749 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00291 |
| scoring_system |
epss |
| scoring_elements |
0.52809 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00291 |
| scoring_system |
epss |
| scoring_elements |
0.52815 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00291 |
| scoring_system |
epss |
| scoring_elements |
0.52798 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00291 |
| scoring_system |
epss |
| scoring_elements |
0.52772 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00291 |
| scoring_system |
epss |
| scoring_elements |
0.52797 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-14664 |
|
| 2 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-14664
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-2txy-d7e8-2udh |
|
| 8 |
| url |
VCID-314g-t8xy-5khg |
| vulnerability_id |
VCID-314g-t8xy-5khg |
| summary |
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop). |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-11619 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01367 |
| scoring_system |
epss |
| scoring_elements |
0.80577 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.01367 |
| scoring_system |
epss |
| scoring_elements |
0.80557 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.01367 |
| scoring_system |
epss |
| scoring_elements |
0.80561 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.01367 |
| scoring_system |
epss |
| scoring_elements |
0.80564 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.01367 |
| scoring_system |
epss |
| scoring_elements |
0.80562 |
| published_at |
2026-06-05T12:55:00Z |
|
| 5 |
| value |
0.01367 |
| scoring_system |
epss |
| scoring_elements |
0.80535 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-11619 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-11619, GHSA-27xj-rqx5-2255
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-314g-t8xy-5khg |
|
| 9 |
| url |
VCID-36gs-6eku-tbgr |
| vulnerability_id |
VCID-36gs-6eku-tbgr |
| summary |
Previous versions of Puppet Agent didn't verify the peer in the SSL connection prior to downloading the CRL. This issue is resolved in Puppet Agent 6.4.0. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-11751 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00223 |
| scoring_system |
epss |
| scoring_elements |
0.44938 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00223 |
| scoring_system |
epss |
| scoring_elements |
0.45007 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00223 |
| scoring_system |
epss |
| scoring_elements |
0.45011 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00223 |
| scoring_system |
epss |
| scoring_elements |
0.44991 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00223 |
| scoring_system |
epss |
| scoring_elements |
0.44962 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00223 |
| scoring_system |
epss |
| scoring_elements |
0.44974 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-11751 |
|
| 2 |
|
| 3 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-11751
|
| risk_score |
1.6 |
| exploitability |
0.5 |
| weighted_severity |
3.3 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-36gs-6eku-tbgr |
|
| 10 |
| url |
VCID-3mfy-uj9u-d7de |
| vulnerability_id |
VCID-3mfy-uj9u-d7de |
| summary |
silent downgrade |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2019-12781 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.04217 |
| scoring_system |
epss |
| scoring_elements |
0.88977 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.04217 |
| scoring_system |
epss |
| scoring_elements |
0.88962 |
| published_at |
2026-06-06T12:55:00Z |
|
| 2 |
| value |
0.04217 |
| scoring_system |
epss |
| scoring_elements |
0.88961 |
| published_at |
2026-06-08T12:55:00Z |
|
| 3 |
| value |
0.04217 |
| scoring_system |
epss |
| scoring_elements |
0.88944 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2019-12781 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
| reference_url |
https://github.com/advisories/GHSA-6c7v-2f49-8h26 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-6c7v-2f49-8h26 |
|
| 11 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
| reference_url |
https://seclists.org/bugtraq/2019/Jul/10 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://seclists.org/bugtraq/2019/Jul/10 |
|
| 17 |
|
| 18 |
|
| 19 |
| reference_url |
https://usn.ubuntu.com/4043-1 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://usn.ubuntu.com/4043-1 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
|
| fixed_packages |
|
| aliases |
CVE-2019-12781, GHSA-6c7v-2f49-8h26, PYSEC-2019-10
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3mfy-uj9u-d7de |
|
| 11 |
| url |
VCID-3qrb-zzte-k7aa |
| vulnerability_id |
VCID-3qrb-zzte-k7aa |
| summary |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
pulp 2.16.x and possibly older is vulnerable to an improper path parsing. A malicious user or a malicious iso feed repository can write to locations accessible to the 'apache' user. This may lead to overwrite of published content on other iso repositories. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-10917 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00271 |
| scoring_system |
epss |
| scoring_elements |
0.50766 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00271 |
| scoring_system |
epss |
| scoring_elements |
0.50734 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.00271 |
| scoring_system |
epss |
| scoring_elements |
0.50795 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.00271 |
| scoring_system |
epss |
| scoring_elements |
0.508 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.00271 |
| scoring_system |
epss |
| scoring_elements |
0.50781 |
| published_at |
2026-06-07T12:55:00Z |
|
| 5 |
| value |
0.00271 |
| scoring_system |
epss |
| scoring_elements |
0.5075 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-10917 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-10917, GHSA-574p-6fw4-4hw8
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3qrb-zzte-k7aa |
|
| 12 |
| url |
VCID-3xx9-28qw-zqgv |
| vulnerability_id |
VCID-3xx9-28qw-zqgv |
| summary |
foreman: Stored XSS in fact name or value |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2017-15100 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00343 |
| scoring_system |
epss |
| scoring_elements |
0.57176 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00343 |
| scoring_system |
epss |
| scoring_elements |
0.57227 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00343 |
| scoring_system |
epss |
| scoring_elements |
0.57235 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00343 |
| scoring_system |
epss |
| scoring_elements |
0.57223 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00343 |
| scoring_system |
epss |
| scoring_elements |
0.57209 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00343 |
| scoring_system |
epss |
| scoring_elements |
0.57226 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2017-15100 |
|
| 2 |
|
|
| fixed_packages |
|
| aliases |
CVE-2017-15100
|
| risk_score |
2.8 |
| exploitability |
0.5 |
| weighted_severity |
5.5 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3xx9-28qw-zqgv |
|
| 13 |
| url |
VCID-4jws-fjy9-63g8 |
| vulnerability_id |
VCID-4jws-fjy9-63g8 |
| summary |
foreman: Ovirt admin password exposed by foreman API |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-1097 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57383 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57436 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57445 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57434 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57421 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57438 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-1097 |
|
| 2 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-1097
|
| risk_score |
3.5 |
| exploitability |
0.5 |
| weighted_severity |
6.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4jws-fjy9-63g8 |
|
| 14 |
| url |
VCID-4mtm-6bjh-7ka1 |
| vulnerability_id |
VCID-4mtm-6bjh-7ka1 |
| summary |
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction between serialization gadgets and typing, related to `com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig` (aka `ibatis-sqlmap`). |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-9547 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.38262 |
| scoring_system |
epss |
| scoring_elements |
0.9732 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.38262 |
| scoring_system |
epss |
| scoring_elements |
0.97319 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.38262 |
| scoring_system |
epss |
| scoring_elements |
0.97317 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.38262 |
| scoring_system |
epss |
| scoring_elements |
0.97318 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.38262 |
| scoring_system |
epss |
| scoring_elements |
0.97312 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-9547 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
| 46 |
|
| 47 |
|
| 48 |
|
| 49 |
|
| 50 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-9547, GHSA-q93h-jc49-78gg
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4mtm-6bjh-7ka1 |
|
| 15 |
| url |
VCID-4nxt-wsu3-2yat |
| vulnerability_id |
VCID-4nxt-wsu3-2yat |
| summary |
foreman: authorization bypasses in foreman-tasks leading to information disclosure |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2019-10198 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01396 |
| scoring_system |
epss |
| scoring_elements |
0.80731 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.01396 |
| scoring_system |
epss |
| scoring_elements |
0.80758 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.01396 |
| scoring_system |
epss |
| scoring_elements |
0.8076 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.01396 |
| scoring_system |
epss |
| scoring_elements |
0.80756 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.01396 |
| scoring_system |
epss |
| scoring_elements |
0.80753 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.01396 |
| scoring_system |
epss |
| scoring_elements |
0.80773 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2019-10198 |
|
| 2 |
|
|
| fixed_packages |
|
| aliases |
CVE-2019-10198
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4nxt-wsu3-2yat |
|
| 16 |
| url |
VCID-4sjm-zyf8-eyf5 |
| vulnerability_id |
VCID-4sjm-zyf8-eyf5 |
| summary |
Cleartext Transmission of Sensitive Information
Handling of the `close_notify` SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2019-0231 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00707 |
| scoring_system |
epss |
| scoring_elements |
0.72573 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00707 |
| scoring_system |
epss |
| scoring_elements |
0.72581 |
| published_at |
2026-06-06T12:55:00Z |
|
| 2 |
| value |
0.00707 |
| scoring_system |
epss |
| scoring_elements |
0.72562 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.00707 |
| scoring_system |
epss |
| scoring_elements |
0.72548 |
| published_at |
2026-06-08T12:55:00Z |
|
| 4 |
| value |
0.00707 |
| scoring_system |
epss |
| scoring_elements |
0.72534 |
| published_at |
2026-06-04T12:55:00Z |
|
| 5 |
| value |
0.00707 |
| scoring_system |
epss |
| scoring_elements |
0.72574 |
| published_at |
2026-06-05T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2019-0231 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2019-0231, GHSA-5h29-qq92-wj7f
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-4sjm-zyf8-eyf5 |
|
| 17 |
| url |
VCID-58n5-hqdf-xff2 |
| vulnerability_id |
VCID-58n5-hqdf-xff2 |
| summary |
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4, 2.8.11.6, and 2.7.9.7 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core). |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-9548, GHSA-p43x-xfjf-5jhr
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-58n5-hqdf-xff2 |
|
| 18 |
| url |
VCID-5cnk-a9hu-y7ft |
| vulnerability_id |
VCID-5cnk-a9hu-y7ft |
| summary |
No validation of hostname certificate
Net-ldap does not validate the hostname certificate. Ruby is relying on OpenSSL, and one common mistake made by users of OpenSSL is to assume that OpenSSL will validate the hostname in the server's certificate. did not perform hostname validation. and up contain support for hostname validation, but they still require the user to call a few functions to set it up. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2017-17718 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00172 |
| scoring_system |
epss |
| scoring_elements |
0.38221 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00172 |
| scoring_system |
epss |
| scoring_elements |
0.38177 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.00172 |
| scoring_system |
epss |
| scoring_elements |
0.38266 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.00172 |
| scoring_system |
epss |
| scoring_elements |
0.38269 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.00172 |
| scoring_system |
epss |
| scoring_elements |
0.38241 |
| published_at |
2026-06-07T12:55:00Z |
|
| 5 |
| value |
0.00172 |
| scoring_system |
epss |
| scoring_elements |
0.38211 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2017-17718 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
|
| fixed_packages |
|
| aliases |
CVE-2017-17718, GHSA-m7p8-9w66-9frm
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5cnk-a9hu-y7ft |
|
| 19 |
| url |
VCID-5er7-a5s5-e7hg |
| vulnerability_id |
VCID-5er7-a5s5-e7hg |
| summary |
Improper Certificate Validation in Puppet
Previously, Puppet operated on a model that a node with a valid certificate
was entitled to all information in the system and that a compromised certificate
allowed access to everything in the infrastructure. When a node's catalog falls
back to the `default` node, the catalog can be retrieved for a different node by
modifying facts for the Puppet run. This issue can be mitigated by setting
`strict_hostname_checking = true` in `puppet.conf` on your Puppet master. Puppet
6.13.0 changes the default behavior for strict_hostname_checking from false to
true. It is recommended that Puppet Open Source and Puppet Enterprise users that
are not upgrading still set `strict_hostname_checking` to `true` to ensure secure
behavior. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-7942 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00113 |
| scoring_system |
epss |
| scoring_elements |
0.29394 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00113 |
| scoring_system |
epss |
| scoring_elements |
0.29414 |
| published_at |
2026-06-07T12:55:00Z |
|
| 2 |
| value |
0.00113 |
| scoring_system |
epss |
| scoring_elements |
0.29483 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.00113 |
| scoring_system |
epss |
| scoring_elements |
0.29447 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.00113 |
| scoring_system |
epss |
| scoring_elements |
0.2938 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-7942 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-7942, GHSA-gqvf-892r-vjm5
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5er7-a5s5-e7hg |
|
| 20 |
| url |
VCID-5pwz-mdv3-dkak |
| vulnerability_id |
VCID-5pwz-mdv3-dkak |
| summary |
Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES/ECIES CBC mode vulnerable to padding oracle attack. For BC 1.55 and older, in an environment where timings can be easily observed, it is possible with enough observations to identify when the decryption is failing due to padding. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000345 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00802 |
| scoring_system |
epss |
| scoring_elements |
0.74445 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00802 |
| scoring_system |
epss |
| scoring_elements |
0.74483 |
| published_at |
2026-06-06T12:55:00Z |
|
| 2 |
| value |
0.00802 |
| scoring_system |
epss |
| scoring_elements |
0.7448 |
| published_at |
2026-06-09T12:55:00Z |
|
| 3 |
| value |
0.00802 |
| scoring_system |
epss |
| scoring_elements |
0.74453 |
| published_at |
2026-06-08T12:55:00Z |
|
| 4 |
| value |
0.00802 |
| scoring_system |
epss |
| scoring_elements |
0.74471 |
| published_at |
2026-06-07T12:55:00Z |
|
| 5 |
| value |
0.00802 |
| scoring_system |
epss |
| scoring_elements |
0.74477 |
| published_at |
2026-06-05T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000345 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
|
| fixed_packages |
|
| aliases |
CVE-2016-1000345, GHSA-9gp4-qrff-c648
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-5pwz-mdv3-dkak |
|
| 21 |
| url |
VCID-6xc5-88jj-yya5 |
| vulnerability_id |
VCID-6xc5-88jj-yya5 |
| summary |
Possible XSS vulnerability in ActionView
There is a possible XSS vulnerability in ActionView's JavaScript literal
escape helpers. Views that use the `j` or `escape_javascript` methods
may be susceptible to XSS attacks.
Versions Affected: All.
Not affected: None.
Fixed Versions: 6.0.2.2, 5.2.4.2
Impact
------
There is a possible XSS vulnerability in the `j` and `escape_javascript`
methods in ActionView. These methods are used for escaping JavaScript string
literals. Impacted code will look something like this:
```erb
<script>let a = `<%= j unknown_input %>`</script>
```
or
```erb
<script>let a = `<%= escape_javascript unknown_input %>`</script>
```
Releases
--------
The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.
Workarounds
-----------
For those that can't upgrade, the following monkey patch may be used:
```ruby
ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
{
"`" => "\\`",
"$" => "\\$"
}
)
module ActionView::Helpers::JavaScriptHelper
alias :old_ej :escape_javascript
alias :old_j :j
def escape_javascript(javascript)
javascript = javascript.to_s
if javascript.empty?
result = ""
else
result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
end
javascript.html_safe? ? result.html_safe : result
end
alias :j :escape_javascript
end
``` |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-5267 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00887 |
| scoring_system |
epss |
| scoring_elements |
0.75869 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00887 |
| scoring_system |
epss |
| scoring_elements |
0.75845 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.00887 |
| scoring_system |
epss |
| scoring_elements |
0.75857 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.00887 |
| scoring_system |
epss |
| scoring_elements |
0.75865 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.00887 |
| scoring_system |
epss |
| scoring_elements |
0.75839 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-5267 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-5267, GHSA-65cv-r6x7-79hv
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6xc5-88jj-yya5 |
|
| 22 |
| url |
VCID-6zct-y89u-2bag |
| vulnerability_id |
VCID-6zct-y89u-2bag |
| summary |
Uncontrolled Resource Consumption
There is a possible DoS vulnerability in the multipart parser in Rack. Specially crafted requests can cause the multipart parser to enter a pathological state, causing the parser to use CPU resources disproportionate to the request size. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-16470 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00177 |
| scoring_system |
epss |
| scoring_elements |
0.38999 |
| published_at |
2026-06-08T12:55:00Z |
|
| 1 |
| value |
0.00177 |
| scoring_system |
epss |
| scoring_elements |
0.38962 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.00177 |
| scoring_system |
epss |
| scoring_elements |
0.39054 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00177 |
| scoring_system |
epss |
| scoring_elements |
0.3905 |
| published_at |
2026-06-05T12:55:00Z |
|
| 4 |
| value |
0.00177 |
| scoring_system |
epss |
| scoring_elements |
0.39011 |
| published_at |
2026-06-09T12:55:00Z |
|
| 5 |
| value |
0.00177 |
| scoring_system |
epss |
| scoring_elements |
0.39025 |
| published_at |
2026-06-07T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-16470 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-16470, GHSA-hg78-4f6x-99wq
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6zct-y89u-2bag |
|
| 23 |
| url |
VCID-72cc-rqu5-hub5 |
| vulnerability_id |
VCID-72cc-rqu5-hub5 |
| summary |
In Bouncy Castle JCE Provider the other party DH public key is not fully validated
In the Bouncy Castle JCE Provider version 1.55 and earlier the other party DH public key is not fully validated. This can cause issues as invalid keys can be used to reveal details about the other party's private key where static Diffie-Hellman is in use. As of release 1.56 the key parameters are checked on agreement calculation. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000346 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00962 |
| scoring_system |
epss |
| scoring_elements |
0.76869 |
| published_at |
2026-06-08T12:55:00Z |
|
| 1 |
| value |
0.00962 |
| scoring_system |
epss |
| scoring_elements |
0.76883 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00962 |
| scoring_system |
epss |
| scoring_elements |
0.76891 |
| published_at |
2026-06-09T12:55:00Z |
|
| 3 |
| value |
0.00962 |
| scoring_system |
epss |
| scoring_elements |
0.7688 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00989 |
| scoring_system |
epss |
| scoring_elements |
0.7721 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000346 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
|
| fixed_packages |
|
| aliases |
CVE-2016-1000346, GHSA-fjqm-246c-mwqg
|
| risk_score |
2.1 |
| exploitability |
0.5 |
| weighted_severity |
4.3 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-72cc-rqu5-hub5 |
|
| 24 |
| url |
VCID-7pd3-dre3-wug9 |
| vulnerability_id |
VCID-7pd3-dre3-wug9 |
| summary |
Information exposure in FasterXML jackson-databind
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2019-12086 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.15522 |
| scoring_system |
epss |
| scoring_elements |
0.94806 |
| published_at |
2026-06-05T12:55:00Z |
|
| 1 |
| value |
0.15522 |
| scoring_system |
epss |
| scoring_elements |
0.94807 |
| published_at |
2026-06-06T12:55:00Z |
|
| 2 |
| value |
0.15522 |
| scoring_system |
epss |
| scoring_elements |
0.94808 |
| published_at |
2026-06-08T12:55:00Z |
|
| 3 |
| value |
0.15522 |
| scoring_system |
epss |
| scoring_elements |
0.94797 |
| published_at |
2026-06-04T12:55:00Z |
|
| 4 |
| value |
0.15522 |
| scoring_system |
epss |
| scoring_elements |
0.94813 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2019-12086 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
| 46 |
|
| 47 |
|
| 48 |
|
| 49 |
|
| 50 |
|
| 51 |
|
| 52 |
|
| 53 |
|
| 54 |
|
| 55 |
|
| 56 |
|
| 57 |
|
| 58 |
|
| 59 |
|
| 60 |
|
| 61 |
|
| 62 |
|
| 63 |
|
| 64 |
|
|
| fixed_packages |
|
| aliases |
CVE-2019-12086, GHSA-5ww9-j83m-q7qx
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7pd3-dre3-wug9 |
|
| 25 |
| url |
VCID-7svn-u8ub-4faw |
| vulnerability_id |
VCID-7svn-u8ub-4faw |
| summary |
Deserialization of Untrusted Data
FasterXML jackson-databind lacks certain `xbean-reflect/JNDI` blocking, as demonstrated by `org.apache.xbean.propertyeditor.JndiConverter`. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-8840 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.08109 |
| scoring_system |
epss |
| scoring_elements |
0.92326 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.08109 |
| scoring_system |
epss |
| scoring_elements |
0.92312 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.08109 |
| scoring_system |
epss |
| scoring_elements |
0.92315 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.08109 |
| scoring_system |
epss |
| scoring_elements |
0.92318 |
| published_at |
2026-06-05T12:55:00Z |
|
| 4 |
| value |
0.08109 |
| scoring_system |
epss |
| scoring_elements |
0.92304 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-8840 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
| 46 |
|
| 47 |
|
| 48 |
|
| 49 |
|
| 50 |
|
| 51 |
|
| 52 |
|
| 53 |
|
| 54 |
|
| 55 |
|
| 56 |
|
| 57 |
|
| 58 |
|
| 59 |
|
| 60 |
|
| 61 |
|
| 62 |
|
| 63 |
|
| 64 |
|
| 65 |
|
| 66 |
|
| 67 |
|
| 68 |
|
| 69 |
|
| 70 |
|
| 71 |
|
| 72 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-8840, GHSA-4w82-r329-3q67
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-7svn-u8ub-4faw |
|
| 26 |
| url |
VCID-89dx-2s8k-mufw |
| vulnerability_id |
VCID-89dx-2s8k-mufw |
| summary |
Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2). |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-14062 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.09872 |
| scoring_system |
epss |
| scoring_elements |
0.93149 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.09872 |
| scoring_system |
epss |
| scoring_elements |
0.9314 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.09872 |
| scoring_system |
epss |
| scoring_elements |
0.93143 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.09872 |
| scoring_system |
epss |
| scoring_elements |
0.93145 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.09872 |
| scoring_system |
epss |
| scoring_elements |
0.93146 |
| published_at |
2026-06-05T12:55:00Z |
|
| 5 |
| value |
0.09872 |
| scoring_system |
epss |
| scoring_elements |
0.93135 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-14062 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-14062, GHSA-c265-37vj-cwcc
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-89dx-2s8k-mufw |
|
| 27 |
|
| 28 |
| url |
VCID-ah8x-azmn-zbgq |
| vulnerability_id |
VCID-ah8x-azmn-zbgq |
| summary |
Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2015-6644 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00184 |
| scoring_system |
epss |
| scoring_elements |
0.39842 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00184 |
| scoring_system |
epss |
| scoring_elements |
0.39926 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00184 |
| scoring_system |
epss |
| scoring_elements |
0.3993 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00184 |
| scoring_system |
epss |
| scoring_elements |
0.39904 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00184 |
| scoring_system |
epss |
| scoring_elements |
0.39877 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00184 |
| scoring_system |
epss |
| scoring_elements |
0.39894 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2015-6644 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
|
| fixed_packages |
|
| aliases |
CVE-2015-6644
|
| risk_score |
2.5 |
| exploitability |
0.5 |
| weighted_severity |
5.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ah8x-azmn-zbgq |
|
| 29 |
| url |
VCID-aprk-8emm-9kbt |
| vulnerability_id |
VCID-aprk-8emm-9kbt |
| summary |
pulp: sensitive credentials revealed through the API |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-1090 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00274 |
| scoring_system |
epss |
| scoring_elements |
0.51045 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00274 |
| scoring_system |
epss |
| scoring_elements |
0.51106 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00274 |
| scoring_system |
epss |
| scoring_elements |
0.51112 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00274 |
| scoring_system |
epss |
| scoring_elements |
0.5109 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00274 |
| scoring_system |
epss |
| scoring_elements |
0.5106 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00274 |
| scoring_system |
epss |
| scoring_elements |
0.51079 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-1090 |
|
| 2 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-1090
|
| risk_score |
2.5 |
| exploitability |
0.5 |
| weighted_severity |
5.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-aprk-8emm-9kbt |
|
| 30 |
| url |
VCID-bb29-8jkm-9bab |
| vulnerability_id |
VCID-bb29-8jkm-9bab |
| summary |
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2019-12387 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01819 |
| scoring_system |
epss |
| scoring_elements |
0.83236 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.01819 |
| scoring_system |
epss |
| scoring_elements |
0.8323 |
| published_at |
2026-06-07T12:55:00Z |
|
| 2 |
| value |
0.01819 |
| scoring_system |
epss |
| scoring_elements |
0.83235 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.01819 |
| scoring_system |
epss |
| scoring_elements |
0.83234 |
| published_at |
2026-06-05T12:55:00Z |
|
| 4 |
| value |
0.01819 |
| scoring_system |
epss |
| scoring_elements |
0.83208 |
| published_at |
2026-06-04T12:55:00Z |
|
| 5 |
| value |
0.01819 |
| scoring_system |
epss |
| scoring_elements |
0.83223 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2019-12387 |
|
| 4 |
|
| 5 |
|
| 6 |
| reference_url |
https://github.com/advisories/GHSA-6cc5-2vg4-cc7m |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-6cc5-2vg4-cc7m |
|
| 7 |
|
| 8 |
| reference_url |
https://github.com/twisted/twisted |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/twisted/twisted |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
| reference_url |
https://usn.ubuntu.com/4308-1 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://usn.ubuntu.com/4308-1 |
|
| 16 |
|
| 17 |
| reference_url |
https://usn.ubuntu.com/4308-2 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://usn.ubuntu.com/4308-2 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
|
| fixed_packages |
|
| aliases |
CVE-2019-12387, GHSA-6cc5-2vg4-cc7m, PYSEC-2019-128
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bb29-8jkm-9bab |
|
| 31 |
| url |
VCID-bf8c-jrdf-mfaw |
| vulnerability_id |
VCID-bf8c-jrdf-mfaw |
| summary |
In Bouncy Castle JCE Provider the DHIES implementation allowed the use of ECB mode
In the Bouncy Castle JCE Provider version 1.55 and earlier the DHIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000344 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60269 |
| published_at |
2026-06-05T12:55:00Z |
|
| 1 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.6026 |
| published_at |
2026-06-09T12:55:00Z |
|
| 2 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60242 |
| published_at |
2026-06-08T12:55:00Z |
|
| 3 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60259 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60272 |
| published_at |
2026-06-06T12:55:00Z |
|
| 5 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60223 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000344 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
|
| fixed_packages |
|
| aliases |
CVE-2016-1000344, GHSA-2j2x-hx4g-2gf4
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bf8c-jrdf-mfaw |
|
| 32 |
| url |
VCID-c58g-7jpv-t7hc |
| vulnerability_id |
VCID-c58g-7jpv-t7hc |
| summary |
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-7536 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01372 |
| scoring_system |
epss |
| scoring_elements |
0.80581 |
| published_at |
2026-06-08T12:55:00Z |
|
| 1 |
| value |
0.01372 |
| scoring_system |
epss |
| scoring_elements |
0.8056 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.01372 |
| scoring_system |
epss |
| scoring_elements |
0.80586 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.01372 |
| scoring_system |
epss |
| scoring_elements |
0.80602 |
| published_at |
2026-06-09T12:55:00Z |
|
| 4 |
| value |
0.01372 |
| scoring_system |
epss |
| scoring_elements |
0.80588 |
| published_at |
2026-06-06T12:55:00Z |
|
| 5 |
| value |
0.01372 |
| scoring_system |
epss |
| scoring_elements |
0.80585 |
| published_at |
2026-06-07T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-7536 |
|
| 6 |
|
| 7 |
|
| 8 |
| reference_url |
https://github.com/advisories/GHSA-r28v-mw67-m5p9 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
MODERATE |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-r28v-mw67-m5p9 |
|
| 9 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
| reference_url |
https://usn.ubuntu.com/3591-1 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
6.9 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://usn.ubuntu.com/3591-1 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-7536, GHSA-r28v-mw67-m5p9, PYSEC-2018-5
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-c58g-7jpv-t7hc |
|
| 33 |
| url |
VCID-cjnx-86t9-uufs |
| vulnerability_id |
VCID-cjnx-86t9-uufs |
| summary |
In Bouncy Castle JCE Provider the ECIES implementation allowed the use of ECB mode
In the Bouncy Castle JCE Provider version 1.55 and earlier the ECIES implementation allowed the use of ECB mode. This mode is regarded as unsafe and support for it has been removed from the provider. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000352 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60269 |
| published_at |
2026-06-05T12:55:00Z |
|
| 1 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60223 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.6026 |
| published_at |
2026-06-09T12:55:00Z |
|
| 3 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60242 |
| published_at |
2026-06-08T12:55:00Z |
|
| 4 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60259 |
| published_at |
2026-06-07T12:55:00Z |
|
| 5 |
| value |
0.00388 |
| scoring_system |
epss |
| scoring_elements |
0.60272 |
| published_at |
2026-06-06T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000352 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2016-1000352, GHSA-w285-wf9q-5w69
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cjnx-86t9-uufs |
|
| 34 |
| url |
VCID-cjze-s3ny-bbfx |
| vulnerability_id |
VCID-cjze-s3ny-bbfx |
| summary |
In Pallets Jinja before 2.10.1, str.format_map allows a sandbox escape. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2019-10906 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.02334 |
| scoring_system |
epss |
| scoring_elements |
0.8516 |
| published_at |
2026-06-07T12:55:00Z |
|
| 1 |
| value |
0.02334 |
| scoring_system |
epss |
| scoring_elements |
0.85161 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.02334 |
| scoring_system |
epss |
| scoring_elements |
0.85166 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.02334 |
| scoring_system |
epss |
| scoring_elements |
0.85136 |
| published_at |
2026-06-04T12:55:00Z |
|
| 4 |
| value |
0.02334 |
| scoring_system |
epss |
| scoring_elements |
0.85149 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.02334 |
| scoring_system |
epss |
| scoring_elements |
0.85162 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2019-10906 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
| reference_url |
https://github.com/pallets/jinja |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.6 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
|
| 1 |
| value |
7.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/pallets/jinja |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
| reference_url |
https://usn.ubuntu.com/4011-1 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.6 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
|
| 1 |
| value |
7.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://usn.ubuntu.com/4011-1 |
|
| 28 |
|
| 29 |
| reference_url |
https://usn.ubuntu.com/4011-2 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.6 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
|
| 1 |
| value |
7.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://usn.ubuntu.com/4011-2 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
|
| fixed_packages |
|
| aliases |
CVE-2019-10906, GHSA-462w-v97r-4m45, PYSEC-2019-217
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cjze-s3ny-bbfx |
|
| 35 |
| url |
VCID-cnvy-kp5d-pkes |
| vulnerability_id |
VCID-cnvy-kp5d-pkes |
| summary |
Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
In the Bouncy Castle JCE Provider version 1.55 and earlier the primary engine class used for AES was AESFastEngine. Due to the highly table driven approach used in the algorithm it turns out that if the data channel on the CPU can be monitored the lookup table accesses are sufficient to leak information on the AES key being used. There was also a leak in AESEngine although it was substantially less. AESEngine has been modified to remove any signs of leakage (testing carried out on Intel X86-64) and is now the primary AES class for the BC JCE provider from 1.56. Use of AESFastEngine is now only recommended where otherwise deemed appropriate. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000339 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01119 |
| scoring_system |
epss |
| scoring_elements |
0.78607 |
| published_at |
2026-06-06T12:55:00Z |
|
| 1 |
| value |
0.01119 |
| scoring_system |
epss |
| scoring_elements |
0.78572 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.01119 |
| scoring_system |
epss |
| scoring_elements |
0.78603 |
| published_at |
2026-06-09T12:55:00Z |
|
| 3 |
| value |
0.01119 |
| scoring_system |
epss |
| scoring_elements |
0.78597 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.01119 |
| scoring_system |
epss |
| scoring_elements |
0.78599 |
| published_at |
2026-06-05T12:55:00Z |
|
| 5 |
| value |
0.01119 |
| scoring_system |
epss |
| scoring_elements |
0.78586 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000339 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
|
| fixed_packages |
|
| aliases |
CVE-2016-1000339, GHSA-c8xf-m4ff-jcxj
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-cnvy-kp5d-pkes |
|
| 36 |
| url |
VCID-crra-28kn-mqab |
| vulnerability_id |
VCID-crra-28kn-mqab |
| summary |
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config). |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-9546 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.0239 |
| scoring_system |
epss |
| scoring_elements |
0.85331 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.0239 |
| scoring_system |
epss |
| scoring_elements |
0.85309 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.0239 |
| scoring_system |
epss |
| scoring_elements |
0.85333 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.0239 |
| scoring_system |
epss |
| scoring_elements |
0.85318 |
| published_at |
2026-06-08T12:55:00Z |
|
| 4 |
| value |
0.0239 |
| scoring_system |
epss |
| scoring_elements |
0.85338 |
| published_at |
2026-06-06T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-9546 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
| 46 |
|
| 47 |
|
| 48 |
|
| 49 |
|
| 50 |
|
| 51 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-9546, GHSA-5p34-5m6p-p58g
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-crra-28kn-mqab |
|
| 37 |
| url |
VCID-dd77-bpcr-zfam |
| vulnerability_id |
VCID-dd77-bpcr-zfam |
| summary |
Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity). |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-14195 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.09286 |
| scoring_system |
epss |
| scoring_elements |
0.92906 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.09286 |
| scoring_system |
epss |
| scoring_elements |
0.92896 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.09286 |
| scoring_system |
epss |
| scoring_elements |
0.92898 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.09286 |
| scoring_system |
epss |
| scoring_elements |
0.92903 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.09286 |
| scoring_system |
epss |
| scoring_elements |
0.92907 |
| published_at |
2026-06-05T12:55:00Z |
|
| 5 |
| value |
0.09286 |
| scoring_system |
epss |
| scoring_elements |
0.92895 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-14195 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-14195, GHSA-mc6h-4qgp-37qh
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dd77-bpcr-zfam |
|
| 38 |
| url |
VCID-dg1c-memc-v3et |
| vulnerability_id |
VCID-dg1c-memc-v3et |
| summary |
The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks
A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2019-10219 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01674 |
| scoring_system |
epss |
| scoring_elements |
0.825 |
| published_at |
2026-06-08T12:55:00Z |
|
| 1 |
| value |
0.01674 |
| scoring_system |
epss |
| scoring_elements |
0.82513 |
| published_at |
2026-06-09T12:55:00Z |
|
| 2 |
| value |
0.01674 |
| scoring_system |
epss |
| scoring_elements |
0.8251 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.01674 |
| scoring_system |
epss |
| scoring_elements |
0.82511 |
| published_at |
2026-06-05T12:55:00Z |
|
| 4 |
| value |
0.01674 |
| scoring_system |
epss |
| scoring_elements |
0.82481 |
| published_at |
2026-06-04T12:55:00Z |
|
| 5 |
| value |
0.01674 |
| scoring_system |
epss |
| scoring_elements |
0.82507 |
| published_at |
2026-06-07T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2019-10219 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
|
| fixed_packages |
|
| aliases |
CVE-2019-10219, GHSA-m8p2-495h-ccmh
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-dg1c-memc-v3et |
|
| 39 |
| url |
VCID-ejgc-vj4y-u3bt |
| vulnerability_id |
VCID-ejgc-vj4y-u3bt |
| summary |
XML Injection (aka Blind XPath Injection)
dom4j version prior to version 2.1.1 contains a CWE-91: XML Injection vulnerability in Class: Element. Methods: addElement, addAttribute that can result in an attacker tampering with XML documents through XML injection. This attack appear to be exploitable via an attacker specifying attributes or elements in the XML document. This vulnerability appears to have been fixed in 2.1.1 or later. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-1000632 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01611 |
| scoring_system |
epss |
| scoring_elements |
0.82126 |
| published_at |
2026-06-08T12:55:00Z |
|
| 1 |
| value |
0.01611 |
| scoring_system |
epss |
| scoring_elements |
0.82101 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.01611 |
| scoring_system |
epss |
| scoring_elements |
0.8214 |
| published_at |
2026-06-09T12:55:00Z |
|
| 3 |
| value |
0.01611 |
| scoring_system |
epss |
| scoring_elements |
0.8213 |
| published_at |
2026-06-05T12:55:00Z |
|
| 4 |
| value |
0.01611 |
| scoring_system |
epss |
| scoring_elements |
0.82131 |
| published_at |
2026-06-06T12:55:00Z |
|
| 5 |
| value |
0.01611 |
| scoring_system |
epss |
| scoring_elements |
0.82133 |
| published_at |
2026-06-07T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-1000632 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-1000632, GHSA-6pcc-3rfx-4gpm
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ejgc-vj4y-u3bt |
|
| 40 |
| url |
VCID-f7yt-1t4f-ufhx |
| vulnerability_id |
VCID-f7yt-1t4f-ufhx |
| summary |
secure_headers directive injection using semicolon
If user-supplied input was passed into append/override_content_security_policy_directives,
a semicolon could be injected leading to directive injection.
This could be used to e.g. override a script-src directive. Duplicate directives are ignored
and the first one wins. The directives in secure_headers are sorted alphabetically so they
pretty much all come before script-src. A previously undefined directive would receive a value
even if SecureHeaders::OPT_OUT was supplied.
The fixed versions will silently convert the semicolons to spaces and emit a deprecation warning
when this happens. This will result in innocuous browser console messages if being
exploited/accidentally used. In future releases, we will raise application errors resulting in
500s.
> Duplicate script-src directives detected. All but the first instance will be ignored.
See https://www.w3.org/TR/CSP3/#parse-serialized-policy
> Note: In this case, the user agent SHOULD notify developers that a duplicate directive was
> ignored. A console warning might be appropriate, for example.
# Workarounds
If you are passing user input into the above methods, you could filter out the input:
```
override_content_security_policy_directives(:frame_src, [user_input.gsub(";", " ")])
``` |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-5217 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00521 |
| scoring_system |
epss |
| scoring_elements |
0.67233 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00521 |
| scoring_system |
epss |
| scoring_elements |
0.67218 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.00521 |
| scoring_system |
epss |
| scoring_elements |
0.67235 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.00521 |
| scoring_system |
epss |
| scoring_elements |
0.67242 |
| published_at |
2026-06-05T12:55:00Z |
|
| 4 |
| value |
0.00521 |
| scoring_system |
epss |
| scoring_elements |
0.6725 |
| published_at |
2026-06-06T12:55:00Z |
|
| 5 |
| value |
0.00521 |
| scoring_system |
epss |
| scoring_elements |
0.67202 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-5217 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-5217, GHSA-xq52-rv6w-397c
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-f7yt-1t4f-ufhx |
|
| 41 |
| url |
VCID-fp37-7px7-g3g7 |
| vulnerability_id |
VCID-fp37-7px7-g3g7 |
| summary |
Inconsistent Interpretation of HTTP Requests (HTTP Request Smuggling)
Netty allows HTTP Request Smuggling because it mishandles Transfer-Encoding whitespace (such as a `[space]Transfer-Encoding:chunked line`) and a later Content-Length header. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-7238 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01498 |
| scoring_system |
epss |
| scoring_elements |
0.81485 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.01498 |
| scoring_system |
epss |
| scoring_elements |
0.81448 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.01498 |
| scoring_system |
epss |
| scoring_elements |
0.81475 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.01498 |
| scoring_system |
epss |
| scoring_elements |
0.81477 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.01498 |
| scoring_system |
epss |
| scoring_elements |
0.8147 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-7238 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
| reference_url |
https://netty.io/news |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
|
| 1 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://netty.io/news |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
| 46 |
|
| 47 |
|
| 48 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-7238, GHSA-ff2w-cq2g-wv5f
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-fp37-7px7-g3g7 |
|
| 42 |
| url |
VCID-fydd-euat-suha |
| vulnerability_id |
VCID-fydd-euat-suha |
| summary |
foreman: Recover of plaintext password or token for the compute resources |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2019-3893 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00377 |
| scoring_system |
epss |
| scoring_elements |
0.59538 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00377 |
| scoring_system |
epss |
| scoring_elements |
0.59588 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00377 |
| scoring_system |
epss |
| scoring_elements |
0.59591 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00377 |
| scoring_system |
epss |
| scoring_elements |
0.59582 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00377 |
| scoring_system |
epss |
| scoring_elements |
0.59563 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00377 |
| scoring_system |
epss |
| scoring_elements |
0.5958 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2019-3893 |
|
| 2 |
|
|
| fixed_packages |
|
| aliases |
CVE-2019-3893
|
| risk_score |
2.2 |
| exploitability |
0.5 |
| weighted_severity |
4.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-fydd-euat-suha |
|
| 43 |
| url |
VCID-fzyw-c2ya-r7aw |
| vulnerability_id |
VCID-fzyw-c2ya-r7aw |
| summary |
Cross-site Scripting
A cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locations is able to execute a XSS attacks against other users through the Subscriptions or the Red Hat Repositories wizards. This can possibly lead to malicious code execution and extraction of the anti-CSRF token of higher privileged users. Versions before `3.9.0` are vulnerable. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-16887 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57414 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57359 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57412 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57421 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.5741 |
| published_at |
2026-06-07T12:55:00Z |
|
| 5 |
| value |
0.00346 |
| scoring_system |
epss |
| scoring_elements |
0.57397 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-16887 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-16887, GHSA-mhhc-r88h-2qrm
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-fzyw-c2ya-r7aw |
|
| 44 |
| url |
VCID-gm91-q9vh-1fhs |
| vulnerability_id |
VCID-gm91-q9vh-1fhs |
| summary |
foreman: unauthorized cache read on RPM-based installations through local user |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-14334 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00111 |
| scoring_system |
epss |
| scoring_elements |
0.29041 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00111 |
| scoring_system |
epss |
| scoring_elements |
0.29111 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00111 |
| scoring_system |
epss |
| scoring_elements |
0.29078 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00111 |
| scoring_system |
epss |
| scoring_elements |
0.29042 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00111 |
| scoring_system |
epss |
| scoring_elements |
0.2901 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00111 |
| scoring_system |
epss |
| scoring_elements |
0.2902 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-14334 |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-14334
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
7.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gm91-q9vh-1fhs |
|
| 45 |
| url |
VCID-h4ev-89nd-6bgb |
| vulnerability_id |
VCID-h4ev-89nd-6bgb |
| summary |
Deserialization of Untrusted Data
In Apache Commons Beanutils, a special `BeanIntrospector` class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2019-10086 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01215 |
| scoring_system |
epss |
| scoring_elements |
0.79376 |
| published_at |
2026-06-05T12:55:00Z |
|
| 1 |
| value |
0.01215 |
| scoring_system |
epss |
| scoring_elements |
0.79364 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.01215 |
| scoring_system |
epss |
| scoring_elements |
0.79382 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.01215 |
| scoring_system |
epss |
| scoring_elements |
0.79374 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.01215 |
| scoring_system |
epss |
| scoring_elements |
0.79383 |
| published_at |
2026-06-09T12:55:00Z |
|
| 5 |
| value |
0.01239 |
| scoring_system |
epss |
| scoring_elements |
0.79573 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2019-10086 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
| 46 |
|
| 47 |
|
| 48 |
|
| 49 |
|
| 50 |
|
| 51 |
|
| 52 |
|
| 53 |
|
| 54 |
|
| 55 |
|
| 56 |
|
| 57 |
|
| 58 |
|
| 59 |
|
| 60 |
|
| 61 |
|
| 62 |
|
| 63 |
|
| 64 |
|
| 65 |
|
| 66 |
|
| 67 |
|
| 68 |
|
| 69 |
|
| 70 |
|
| 71 |
|
| 72 |
|
| 73 |
|
| 74 |
|
| 75 |
|
| 76 |
|
| 77 |
|
| 78 |
|
| 79 |
|
| 80 |
|
|
| fixed_packages |
|
| aliases |
CVE-2019-10086, GHSA-6phf-73q6-gh87
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-h4ev-89nd-6bgb |
|
| 46 |
| url |
VCID-hkej-a1pn-2kh3 |
| vulnerability_id |
VCID-hkej-a1pn-2kh3 |
| summary |
Improper Validation of Integrity Check Value
The default BKS keystore use an HMAC that is only 16 bits long, which can allow an attacker to compromise the integrity of a BKS keystore. Bouncy Castle release 1.47 changes the BKS format to a format which uses a 160 bit HMAC instead. This applies to any BKS keystore generated prior to BC 1.47. For situations where people need to create the files for legacy reasons a specific keystore type "BKS-V1" was introduced in 1.49. It should be noted that the use of "BKS-V1" is discouraged by the library authors and should only be used where it is otherwise safe to do so, as in where the use of a 16 bit checksum for the file integrity check is not going to cause a security issue in itself. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-5382 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00153 |
| scoring_system |
epss |
| scoring_elements |
0.35724 |
| published_at |
2026-06-07T12:55:00Z |
|
| 1 |
| value |
0.00153 |
| scoring_system |
epss |
| scoring_elements |
0.35701 |
| published_at |
2026-06-09T12:55:00Z |
|
| 2 |
| value |
0.00153 |
| scoring_system |
epss |
| scoring_elements |
0.35685 |
| published_at |
2026-06-08T12:55:00Z |
|
| 3 |
| value |
0.00153 |
| scoring_system |
epss |
| scoring_elements |
0.3565 |
| published_at |
2026-06-04T12:55:00Z |
|
| 4 |
| value |
0.00153 |
| scoring_system |
epss |
| scoring_elements |
0.35753 |
| published_at |
2026-06-05T12:55:00Z |
|
| 5 |
| value |
0.00153 |
| scoring_system |
epss |
| scoring_elements |
0.35764 |
| published_at |
2026-06-06T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-5382 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-5382, GHSA-8477-3v39-ggpm
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hkej-a1pn-2kh3 |
|
| 47 |
| url |
VCID-huph-y2xr-g3dk |
| vulnerability_id |
VCID-huph-y2xr-g3dk |
| summary |
Percent-encoded cookies can be used to overwrite existing prefixed cookie names
It is possible to forge a secure or host-only cookie prefix in Rack using
an arbitrary cookie write by using URL encoding (percent-encoding) on the
name of the cookie. This could result in an application that is dependent on
this prefix to determine if a cookie is safe to process being manipulated
into processing an insecure or cross-origin request.
This vulnerability has been assigned the CVE identifier CVE-2020-8184.
Versions Affected: rack < 2.2.3, rack < 2.1.4
Not affected: Applications which do not rely on __Host- and __Secure- prefixes to determine if a cookie is safe to process
Fixed Versions: rack >= 2.2.3, rack >= 2.1.4
Impact
------
An attacker may be able to trick a vulnerable application into processing an
insecure (non-SSL) or cross-origin request if they can gain the ability to write
arbitrary cookies that are sent to the application.
Workarounds
-----------
If your application is impacted but you cannot upgrade to the released versions or apply
the provided patch, this issue can be temporarily addressed by adding the following workaround:
```
module Rack
module Utils
module_function def parse_cookies_header(header)
return {} unless header
header.split(/[;] */n).each_with_object({}) do |cookie, cookies|
next if cookie.empty?
key, value = cookie.split('=', 2)
cookies[key] = (unescape(value) rescue value) unless cookies.key?(key)
end
end
end
end
``` |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-8184 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00811 |
| scoring_system |
epss |
| scoring_elements |
0.74625 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00811 |
| scoring_system |
epss |
| scoring_elements |
0.74599 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.00811 |
| scoring_system |
epss |
| scoring_elements |
0.74616 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.00811 |
| scoring_system |
epss |
| scoring_elements |
0.74628 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.00811 |
| scoring_system |
epss |
| scoring_elements |
0.74622 |
| published_at |
2026-06-05T12:55:00Z |
|
| 5 |
| value |
0.00811 |
| scoring_system |
epss |
| scoring_elements |
0.74591 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-8184 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-8184, GHSA-j6w9-fv6q-3q52
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-huph-y2xr-g3dk |
|
| 48 |
| url |
VCID-j1qe-t57w-tkdx |
| vulnerability_id |
VCID-j1qe-t57w-tkdx |
| summary |
Improper Access Control
A vulnerability in the MySQL Connectors component of Oracle MySQL exists. Successful attacks of this vulnerability can result in takeover of MySQL Connectors. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-3258 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.04126 |
| scoring_system |
epss |
| scoring_elements |
0.88829 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.04126 |
| scoring_system |
epss |
| scoring_elements |
0.88844 |
| published_at |
2026-06-07T12:55:00Z |
|
| 2 |
| value |
0.04126 |
| scoring_system |
epss |
| scoring_elements |
0.88846 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.04126 |
| scoring_system |
epss |
| scoring_elements |
0.88843 |
| published_at |
2026-06-08T12:55:00Z |
|
| 4 |
| value |
0.04126 |
| scoring_system |
epss |
| scoring_elements |
0.8886 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-3258 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-3258, GHSA-4vrv-ch96-6h42
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-j1qe-t57w-tkdx |
|
| 49 |
| url |
VCID-jbuu-hpb4-3fa4 |
| vulnerability_id |
VCID-jbuu-hpb4-3fa4 |
| summary |
Deserialization of Untrusted Data
Unbounded memory allocation allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the `AtomicDoubleArray` class (when serialized with Java serialization) and the `CompoundOrdering` class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-10237 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.03259 |
| scoring_system |
epss |
| scoring_elements |
0.87408 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.03259 |
| scoring_system |
epss |
| scoring_elements |
0.87378 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.03259 |
| scoring_system |
epss |
| scoring_elements |
0.874 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.03259 |
| scoring_system |
epss |
| scoring_elements |
0.87398 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.03259 |
| scoring_system |
epss |
| scoring_elements |
0.87395 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-10237 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
| 46 |
|
| 47 |
|
| 48 |
|
| 49 |
|
| 50 |
|
| 51 |
|
| 52 |
|
| 53 |
|
| 54 |
|
| 55 |
|
| 56 |
|
| 57 |
|
| 58 |
|
| 59 |
|
| 60 |
|
| 61 |
|
| 62 |
|
| 63 |
|
| 64 |
|
| 65 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-10237, GHSA-mvr2-9pj6-7w5j
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jbuu-hpb4-3fa4 |
|
| 50 |
| url |
VCID-jfmc-7tky-mqdw |
| vulnerability_id |
VCID-jfmc-7tky-mqdw |
| summary |
Cross-site scripting (XSS) vulnerability in the render_full function in debug/tbtools.py in the debugger in Pallets Werkzeug before 0.11.11 (as used in Pallets Flask and other products) allows remote attackers to inject arbitrary web script or HTML via a field that contains an exception message. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2016-10516 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00411 |
| scoring_system |
epss |
| scoring_elements |
0.6172 |
| published_at |
2026-06-08T12:55:00Z |
|
| 1 |
| value |
0.00411 |
| scoring_system |
epss |
| scoring_elements |
0.61735 |
| published_at |
2026-06-07T12:55:00Z |
|
| 2 |
| value |
0.00411 |
| scoring_system |
epss |
| scoring_elements |
0.61747 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00411 |
| scoring_system |
epss |
| scoring_elements |
0.6174 |
| published_at |
2026-06-05T12:55:00Z |
|
| 4 |
| value |
0.00411 |
| scoring_system |
epss |
| scoring_elements |
0.61737 |
| published_at |
2026-06-09T12:55:00Z |
|
| 5 |
| value |
0.00411 |
| scoring_system |
epss |
| scoring_elements |
0.61691 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2016-10516 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
|
| fixed_packages |
|
| aliases |
CVE-2016-10516, GHSA-h2fp-xgx6-xh6f, PYSEC-2017-43
|
| risk_score |
3.2 |
| exploitability |
0.5 |
| weighted_severity |
6.4 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jfmc-7tky-mqdw |
|
| 51 |
| url |
VCID-jmx5-8993-kqeh |
| vulnerability_id |
VCID-jmx5-8993-kqeh |
| summary |
Katello cleartext password storage issue
A cleartext password storage issue was discovered in Katello, versions
3.x.x.x before katello 3.12.2. Registry credentials used during container image
discovery were inadvertently logged without being masked. This flaw could expose
the registry credentials to other privileged users. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2019-14825 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00152 |
| scoring_system |
epss |
| scoring_elements |
0.35724 |
| published_at |
2026-06-06T12:55:00Z |
|
| 1 |
| value |
0.00152 |
| scoring_system |
epss |
| scoring_elements |
0.35713 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00152 |
| scoring_system |
epss |
| scoring_elements |
0.35658 |
| published_at |
2026-06-09T12:55:00Z |
|
| 3 |
| value |
0.00152 |
| scoring_system |
epss |
| scoring_elements |
0.35611 |
| published_at |
2026-06-04T12:55:00Z |
|
| 4 |
| value |
0.00152 |
| scoring_system |
epss |
| scoring_elements |
0.35643 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00152 |
| scoring_system |
epss |
| scoring_elements |
0.35684 |
| published_at |
2026-06-07T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2019-14825 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
|
| fixed_packages |
|
| aliases |
CVE-2019-14825, GHSA-m4wh-848j-9w2r
|
| risk_score |
1.9 |
| exploitability |
0.5 |
| weighted_severity |
3.7 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-jmx5-8993-kqeh |
|
| 52 |
| url |
VCID-js4m-yqqf-4ubd |
| vulnerability_id |
VCID-js4m-yqqf-4ubd |
| summary |
In Pallets Jinja before 2.8.1, str.format allows a sandbox escape. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2016-10745 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01022 |
| scoring_system |
epss |
| scoring_elements |
0.77617 |
| published_at |
2026-06-05T12:55:00Z |
|
| 1 |
| value |
0.01022 |
| scoring_system |
epss |
| scoring_elements |
0.7759 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.01022 |
| scoring_system |
epss |
| scoring_elements |
0.77616 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.01022 |
| scoring_system |
epss |
| scoring_elements |
0.77605 |
| published_at |
2026-06-08T12:55:00Z |
|
| 4 |
| value |
0.01022 |
| scoring_system |
epss |
| scoring_elements |
0.77624 |
| published_at |
2026-06-09T12:55:00Z |
|
| 5 |
| value |
0.01022 |
| scoring_system |
epss |
| scoring_elements |
0.77625 |
| published_at |
2026-06-06T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2016-10745 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
| reference_url |
https://github.com/pallets/jinja |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.6 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
|
| 1 |
| value |
7.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/pallets/jinja |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
| reference_url |
https://usn.ubuntu.com/4011-1 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.6 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
|
| 1 |
| value |
7.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://usn.ubuntu.com/4011-1 |
|
| 18 |
|
| 19 |
| reference_url |
https://usn.ubuntu.com/4011-2 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
8.6 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
|
| 1 |
| value |
7.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://usn.ubuntu.com/4011-2 |
|
| 20 |
|
| 21 |
|
| 22 |
|
|
| fixed_packages |
|
| aliases |
CVE-2016-10745, GHSA-hj2j-77xm-mc5v, PYSEC-2019-220
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-js4m-yqqf-4ubd |
|
| 53 |
| url |
VCID-kd2v-rt9y-uqh7 |
| vulnerability_id |
VCID-kd2v-rt9y-uqh7 |
| summary |
Possible information leak / session hijack vulnerability
There's a possible information leak / session hijack vulnerability in Rack.
Attackers may be able to find and hijack sessions by using timing attacks
targeting the session id. Session ids are usually stored and indexed in a
database that uses some kind of scheme for speeding up lookups of that
session id. By carefully measuring the amount of time it takes to look up
a session, an attacker may be able to find a valid session id and hijack
the session.
The session id itself may be generated randomly, but the way the session is
indexed by the backing store does not use a secure comparison.
Impact:
The session id stored in a cookie is the same id that is used when querying
the backing session storage engine. Most storage mechanisms (for example a
database) use some sort of indexing in order to speed up the lookup of that
id. By carefully timing requests and session lookup failures, an attacker
may be able to perform a timing attack to determine an existing session id
and hijack that session. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2019-16782 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00892 |
| scoring_system |
epss |
| scoring_elements |
0.75959 |
| published_at |
2026-06-07T12:55:00Z |
|
| 1 |
| value |
0.00892 |
| scoring_system |
epss |
| scoring_elements |
0.75967 |
| published_at |
2026-06-06T12:55:00Z |
|
| 2 |
| value |
0.00892 |
| scoring_system |
epss |
| scoring_elements |
0.75941 |
| published_at |
2026-06-04T12:55:00Z |
|
| 3 |
| value |
0.00892 |
| scoring_system |
epss |
| scoring_elements |
0.7597 |
| published_at |
2026-06-09T12:55:00Z |
|
| 4 |
| value |
0.00892 |
| scoring_system |
epss |
| scoring_elements |
0.75945 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2019-16782 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
|
| fixed_packages |
|
| aliases |
CVE-2019-16782, GHSA-hrqr-hxpp-chr3
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kd2v-rt9y-uqh7 |
|
| 54 |
| url |
VCID-kkv7-r6fj-87h1 |
| vulnerability_id |
VCID-kkv7-r6fj-87h1 |
| summary |
Regular Expression Denial of Service in websocket-extensions (RubyGem)
### Impact
The ReDoS flaw allows an attacker to exhaust the server's capacity to process
incoming requests by sending a WebSocket handshake request containing a header
of the following form:
Sec-WebSocket-Extensions: a; b="\c\c\c\c\c\c\c\c\c\c ...
That is, a header containing an unclosed string parameter value whose content is
a repeating two-byte sequence of a backslash and some other character. The
parser takes exponential time to reject this header as invalid, and this will
block the processing of any other work on the same thread. Thus if you are
running a single-threaded server, such a request can render your service
completely unavailable.
### Workarounds
There are no known work-arounds other than disabling any public-facing WebSocket functionality you are operating. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-7663 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.02622 |
| scoring_system |
epss |
| scoring_elements |
0.85973 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.02622 |
| scoring_system |
epss |
| scoring_elements |
0.8596 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.02622 |
| scoring_system |
epss |
| scoring_elements |
0.85974 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.02622 |
| scoring_system |
epss |
| scoring_elements |
0.85971 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.02622 |
| scoring_system |
epss |
| scoring_elements |
0.85949 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-7663 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-7663, GHSA-g6wq-qcwm-j5g2
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kkv7-r6fj-87h1 |
|
| 55 |
| url |
VCID-kxw5-dx3x-jbep |
| vulnerability_id |
VCID-kxw5-dx3x-jbep |
| summary |
6: XSS in discovery rule filter autocomplete functionality |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2017-12175 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00473 |
| scoring_system |
epss |
| scoring_elements |
0.65064 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00473 |
| scoring_system |
epss |
| scoring_elements |
0.65107 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00473 |
| scoring_system |
epss |
| scoring_elements |
0.65117 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00473 |
| scoring_system |
epss |
| scoring_elements |
0.65106 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00473 |
| scoring_system |
epss |
| scoring_elements |
0.65094 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00473 |
| scoring_system |
epss |
| scoring_elements |
0.65111 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2017-12175 |
|
| 2 |
|
|
| fixed_packages |
|
| aliases |
CVE-2017-12175
|
| risk_score |
1.6 |
| exploitability |
0.5 |
| weighted_severity |
3.1 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kxw5-dx3x-jbep |
|
| 56 |
| url |
VCID-mbfh-q7q1-s7d4 |
| vulnerability_id |
VCID-mbfh-q7q1-s7d4 |
| summary |
Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints. For PuppetDB this may contain things like hostnames. Puppet Server reports resource names and titles for defined types (which may contain sensitive information) as well as function names and class names. Previously, these endpoints were open to the local network. PE 2018.1.13 & 2019.5.0, Puppet Server 6.9.2 & 5.3.12, and PuppetDB 6.9.1 & 5.2.13 disable trapperkeeper-metrics /v1 metrics API and only allows /v2 access on localhost by default. This affects software versions: Puppet Enterprise 2018.1.x stream prior to 2018.1.13 Puppet Enterprise prior to 2019.5.0 Puppet Server prior to 6.9.2 Puppet Server prior to 5.3.12 PuppetDB prior to 6.9.1 PuppetDB prior to 5.2.13 Resolved in: Puppet Enterprise 2018.1.13 Puppet Enterprise 2019.5.0 Puppet Server 6.9.2 Puppet Server 5.3.12 PuppetDB 6.9.1 PuppetDB 5.2.13 |
| references |
|
| fixed_packages |
|
| aliases |
CVE-2020-7943
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mbfh-q7q1-s7d4 |
|
| 57 |
| url |
VCID-mmx3-z8rh-p3bd |
| vulnerability_id |
VCID-mmx3-z8rh-p3bd |
| summary |
Timing attack vulnerability
Sinatra rack-protection contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-1000119 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00403 |
| scoring_system |
epss |
| scoring_elements |
0.61199 |
| published_at |
2026-06-07T12:55:00Z |
|
| 1 |
| value |
0.00403 |
| scoring_system |
epss |
| scoring_elements |
0.61212 |
| published_at |
2026-06-06T12:55:00Z |
|
| 2 |
| value |
0.00403 |
| scoring_system |
epss |
| scoring_elements |
0.61204 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.00403 |
| scoring_system |
epss |
| scoring_elements |
0.61156 |
| published_at |
2026-06-04T12:55:00Z |
|
| 4 |
| value |
0.00403 |
| scoring_system |
epss |
| scoring_elements |
0.61201 |
| published_at |
2026-06-09T12:55:00Z |
|
| 5 |
| value |
0.00403 |
| scoring_system |
epss |
| scoring_elements |
0.61181 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-1000119 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-1000119, GHSA-688c-3x49-6rqj
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mmx3-z8rh-p3bd |
|
| 58 |
| url |
VCID-mn3q-6cs1-ukcq |
| vulnerability_id |
VCID-mn3q-6cs1-ukcq |
| summary |
Improper Privilege Management
In previous versions of Puppet Agent it was possible to install a module with world writable permissions. Puppet Agent 5.3.4 and 1.10.10 included a fix to this vulnerability. |
| references |
| 0 |
|
| 1 |
|
| 2 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2017-10689 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00092 |
| scoring_system |
epss |
| scoring_elements |
0.25747 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00092 |
| scoring_system |
epss |
| scoring_elements |
0.25743 |
| published_at |
2026-06-09T12:55:00Z |
|
| 2 |
| value |
0.00092 |
| scoring_system |
epss |
| scoring_elements |
0.25737 |
| published_at |
2026-06-08T12:55:00Z |
|
| 3 |
| value |
0.00092 |
| scoring_system |
epss |
| scoring_elements |
0.25796 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00092 |
| scoring_system |
epss |
| scoring_elements |
0.25841 |
| published_at |
2026-06-06T12:55:00Z |
|
| 5 |
| value |
0.00092 |
| scoring_system |
epss |
| scoring_elements |
0.2585 |
| published_at |
2026-06-05T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2017-10689 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
|
| fixed_packages |
|
| aliases |
CVE-2017-10689, GHSA-vw22-465p-8j5w
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mn3q-6cs1-ukcq |
|
| 59 |
| url |
VCID-mr8k-d23n-e3c6 |
| vulnerability_id |
VCID-mr8k-d23n-e3c6 |
| summary |
secure_headers header injection due to newline
If user-supplied input was passed into append/override_content_security_policy_directives,
a newline could be injected leading to limited header injection.
Upon seeing a newline in the header, rails will silently create a new Content-Security-Policy
header with the remaining value of the original string. It will continue to create new headers
for each newline.
e.g.
```
override_content_security_directives(script_src: ['mycdn.com', "\ninjected\n"])
```
would result in
```
Content-Security-Policy: ... script-src: mycdn.com
Content-Security-Policy: injected
Content-Security-Policy: rest-of-the-header
```
CSP supports multiple headers and all policies must be satisfied for execution to occur, but a malicious value that reports the current page is fairly trivial:
```
override_content_security_directives(script_src: ["mycdn.com", "\ndefault-src 'none'; report-uri evil.com"])
```
```
Content-Security-Policy: ... script-src: mycdn.com
Content-Security-Policy: default-src 'none'; report-uri evil.com
Content-Security-Policy: rest-of-the-header
```
Workarounds
```
override_content_security_policy_directives(:frame_src, [user_input.gsub("\n", " ")])
``` |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-5216 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00347 |
| scoring_system |
epss |
| scoring_elements |
0.57577 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00347 |
| scoring_system |
epss |
| scoring_elements |
0.5756 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.00347 |
| scoring_system |
epss |
| scoring_elements |
0.57572 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.00347 |
| scoring_system |
epss |
| scoring_elements |
0.57573 |
| published_at |
2026-06-05T12:55:00Z |
|
| 4 |
| value |
0.00347 |
| scoring_system |
epss |
| scoring_elements |
0.57582 |
| published_at |
2026-06-06T12:55:00Z |
|
| 5 |
| value |
0.00347 |
| scoring_system |
epss |
| scoring_elements |
0.57521 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-5216 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-5216, GHSA-w978-rmpf-qmwg
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mr8k-d23n-e3c6 |
|
| 60 |
| url |
VCID-n1sj-dwab-j3ca |
| vulnerability_id |
VCID-n1sj-dwab-j3ca |
| summary |
Directory traversal in Rack::Directory app bundled with Rack
There was a possible directory traversal vulnerability in the Rack::Directory app
that is bundled with Rack.
Versions Affected: rack < 2.2.0
Not affected: Applications that do not use Rack::Directory.
Fixed Versions: 2.1.3, >= 2.2.0
Impact
------
If certain directories exist in a director that is managed by
`Rack::Directory`, an attacker could, using this vulnerability, read the
contents of files on the server that were outside of the root specified in the
Rack::Directory initializer.
Workarounds
-----------
Until such time as the patch is applied or their Rack version is upgraded,
we recommend that developers do not use Rack::Directory in their
applications. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-8161 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00907 |
| scoring_system |
epss |
| scoring_elements |
0.76181 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00907 |
| scoring_system |
epss |
| scoring_elements |
0.76157 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.00907 |
| scoring_system |
epss |
| scoring_elements |
0.76149 |
| published_at |
2026-06-04T12:55:00Z |
|
| 3 |
| value |
0.00907 |
| scoring_system |
epss |
| scoring_elements |
0.76168 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00907 |
| scoring_system |
epss |
| scoring_elements |
0.76176 |
| published_at |
2026-06-06T12:55:00Z |
|
| 5 |
| value |
0.00907 |
| scoring_system |
epss |
| scoring_elements |
0.76174 |
| published_at |
2026-06-05T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-8161 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-8161, GHSA-5f9h-9pjv-v6j7
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-n1sj-dwab-j3ca |
|
| 61 |
| url |
VCID-pj5d-vfar-q7ac |
| vulnerability_id |
VCID-pj5d-vfar-q7ac |
| summary |
Uncontrolled Resource Consumption
RESTEasy enables `GZIPInterceptor`, which allows remote attackers to cause a denial of service via unspecified vectors. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2016-6346 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01184 |
| scoring_system |
epss |
| scoring_elements |
0.79146 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.01184 |
| scoring_system |
epss |
| scoring_elements |
0.79127 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.01184 |
| scoring_system |
epss |
| scoring_elements |
0.79139 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.01184 |
| scoring_system |
epss |
| scoring_elements |
0.79116 |
| published_at |
2026-06-04T12:55:00Z |
|
| 4 |
| value |
0.01184 |
| scoring_system |
epss |
| scoring_elements |
0.79148 |
| published_at |
2026-06-06T12:55:00Z |
|
| 5 |
| value |
0.01184 |
| scoring_system |
epss |
| scoring_elements |
0.79142 |
| published_at |
2026-06-05T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2016-6346 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
|
| fixed_packages |
|
| aliases |
CVE-2016-6346, GHSA-wxvr-vqfp-9cqw
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pj5d-vfar-q7ac |
|
| 62 |
| url |
VCID-pjen-tre3-e7cv |
| vulnerability_id |
VCID-pjen-tre3-e7cv |
| summary |
In previous versions of Puppet Agent it was possible for the agent to retrieve facts from an environment that it was not classified to retrieve from. This was resolved in Puppet Agent 5.3.4, included in Puppet Enterprise 2017.3.4 |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2017-10690 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00193 |
| scoring_system |
epss |
| scoring_elements |
0.41068 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00193 |
| scoring_system |
epss |
| scoring_elements |
0.41144 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00193 |
| scoring_system |
epss |
| scoring_elements |
0.41148 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00193 |
| scoring_system |
epss |
| scoring_elements |
0.41117 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00193 |
| scoring_system |
epss |
| scoring_elements |
0.41086 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00193 |
| scoring_system |
epss |
| scoring_elements |
0.41095 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2017-10690 |
|
| 2 |
|
|
| fixed_packages |
|
| aliases |
CVE-2017-10690
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pjen-tre3-e7cv |
|
| 63 |
| url |
VCID-pzcv-q79p-nbd5 |
| vulnerability_id |
VCID-pzcv-q79p-nbd5 |
| summary |
Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)
An attacker may be able to validate an invalid instance and access the private member value via `ConstraintViolation#getInvalidValue()`. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2017-7536 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00127 |
| scoring_system |
epss |
| scoring_elements |
0.31515 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00127 |
| scoring_system |
epss |
| scoring_elements |
0.31527 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.00127 |
| scoring_system |
epss |
| scoring_elements |
0.31595 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.00127 |
| scoring_system |
epss |
| scoring_elements |
0.31559 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.00127 |
| scoring_system |
epss |
| scoring_elements |
0.31523 |
| published_at |
2026-06-07T12:55:00Z |
|
| 5 |
| value |
0.00127 |
| scoring_system |
epss |
| scoring_elements |
0.31491 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2017-7536 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
|
| fixed_packages |
|
| aliases |
CVE-2017-7536, GHSA-xxgp-pcfc-3vgc
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pzcv-q79p-nbd5 |
|
| 64 |
| url |
VCID-q6zd-khan-9yhj |
| vulnerability_id |
VCID-q6zd-khan-9yhj |
| summary |
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy). |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-10968 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.03824 |
| scoring_system |
epss |
| scoring_elements |
0.8836 |
| published_at |
2026-06-05T12:55:00Z |
|
| 1 |
| value |
0.03824 |
| scoring_system |
epss |
| scoring_elements |
0.88342 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.03824 |
| scoring_system |
epss |
| scoring_elements |
0.88377 |
| published_at |
2026-06-09T12:55:00Z |
|
| 3 |
| value |
0.03824 |
| scoring_system |
epss |
| scoring_elements |
0.88361 |
| published_at |
2026-06-08T12:55:00Z |
|
| 4 |
| value |
0.03824 |
| scoring_system |
epss |
| scoring_elements |
0.88362 |
| published_at |
2026-06-06T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-10968 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-10968, GHSA-rf6r-2c4q-2vwg
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-q6zd-khan-9yhj |
|
| 65 |
| url |
VCID-rh2m-yftg-7uc9 |
| vulnerability_id |
VCID-rh2m-yftg-7uc9 |
| summary |
The Bouncy Castle JCE Provider carry a propagation bug
In the Bouncy Castle JCE Provider versions 1.51 to 1.55, a carry propagation bug was introduced in the implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000340 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00397 |
| scoring_system |
epss |
| scoring_elements |
0.60929 |
| published_at |
2026-06-05T12:55:00Z |
|
| 1 |
| value |
0.00397 |
| scoring_system |
epss |
| scoring_elements |
0.6088 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.00397 |
| scoring_system |
epss |
| scoring_elements |
0.60924 |
| published_at |
2026-06-09T12:55:00Z |
|
| 3 |
| value |
0.00397 |
| scoring_system |
epss |
| scoring_elements |
0.60907 |
| published_at |
2026-06-08T12:55:00Z |
|
| 4 |
| value |
0.00397 |
| scoring_system |
epss |
| scoring_elements |
0.60925 |
| published_at |
2026-06-07T12:55:00Z |
|
| 5 |
| value |
0.00397 |
| scoring_system |
epss |
| scoring_elements |
0.60936 |
| published_at |
2026-06-06T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000340 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
|
| fixed_packages |
|
| aliases |
CVE-2016-1000340, GHSA-r97x-3g8f-gx3m
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rh2m-yftg-7uc9 |
|
| 66 |
| url |
VCID-rruq-9scz-vbg8 |
| vulnerability_id |
VCID-rruq-9scz-vbg8 |
| summary |
Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on success" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs "safe" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2017-7233 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00747 |
| scoring_system |
epss |
| scoring_elements |
0.73483 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00747 |
| scoring_system |
epss |
| scoring_elements |
0.73442 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.00747 |
| scoring_system |
epss |
| scoring_elements |
0.73479 |
| published_at |
2026-06-05T12:55:00Z |
|
| 3 |
| value |
0.00747 |
| scoring_system |
epss |
| scoring_elements |
0.73484 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.00747 |
| scoring_system |
epss |
| scoring_elements |
0.73471 |
| published_at |
2026-06-07T12:55:00Z |
|
| 5 |
| value |
0.00747 |
| scoring_system |
epss |
| scoring_elements |
0.73458 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2017-7233 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
| reference_url |
https://github.com/advisories/GHSA-37hp-765x-j95x |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
MODERATE |
| scoring_system |
cvssv3.1_qr |
| scoring_elements |
|
|
| 2 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 3 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/advisories/GHSA-37hp-765x-j95x |
|
| 15 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
6.1 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
|
| 1 |
| value |
5.3 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
|
| 2 |
| value |
MODERATE |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
|
| fixed_packages |
|
| aliases |
CVE-2017-7233, GHSA-37hp-765x-j95x, PYSEC-2017-9
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rruq-9scz-vbg8 |
|
| 67 |
| url |
VCID-ser1-mtbs-13hx |
| vulnerability_id |
VCID-ser1-mtbs-13hx |
| summary |
foreman: SQL injection due to improper handling of the widget id parameter |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-1096 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00315 |
| scoring_system |
epss |
| scoring_elements |
0.54891 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00315 |
| scoring_system |
epss |
| scoring_elements |
0.54949 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00315 |
| scoring_system |
epss |
| scoring_elements |
0.54957 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00315 |
| scoring_system |
epss |
| scoring_elements |
0.54948 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00315 |
| scoring_system |
epss |
| scoring_elements |
0.54929 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00315 |
| scoring_system |
epss |
| scoring_elements |
0.5495 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-1096 |
|
| 2 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-1096
|
| risk_score |
3.0 |
| exploitability |
0.5 |
| weighted_severity |
5.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ser1-mtbs-13hx |
|
| 68 |
| url |
VCID-sxxg-bjnq-2kf7 |
| vulnerability_id |
VCID-sxxg-bjnq-2kf7 |
| summary |
Moderate severity vulnerability that affects org.bouncycastle:bcprov-jdk14 and org.bouncycastle:bcprov-jdk15
In the Bouncy Castle JCE Provider version 1.55 and earlier DSA signature generation is vulnerable to timing attack. Where timings can be closely observed for the generation of signatures, the lack of blinding in 1.55, or earlier, may allow an attacker to gain information about the signature's k value and ultimately the private value as well. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000341 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00802 |
| scoring_system |
epss |
| scoring_elements |
0.74477 |
| published_at |
2026-06-05T12:55:00Z |
|
| 1 |
| value |
0.00802 |
| scoring_system |
epss |
| scoring_elements |
0.74471 |
| published_at |
2026-06-07T12:55:00Z |
|
| 2 |
| value |
0.00802 |
| scoring_system |
epss |
| scoring_elements |
0.7448 |
| published_at |
2026-06-09T12:55:00Z |
|
| 3 |
| value |
0.00802 |
| scoring_system |
epss |
| scoring_elements |
0.74453 |
| published_at |
2026-06-08T12:55:00Z |
|
| 4 |
| value |
0.00802 |
| scoring_system |
epss |
| scoring_elements |
0.74445 |
| published_at |
2026-06-04T12:55:00Z |
|
| 5 |
| value |
0.00802 |
| scoring_system |
epss |
| scoring_elements |
0.74483 |
| published_at |
2026-06-06T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000341 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
|
| fixed_packages |
|
| aliases |
CVE-2016-1000341, GHSA-r9ch-m4fh-fc7q
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-sxxg-bjnq-2kf7 |
|
| 69 |
| url |
VCID-tbtc-p1y5-qbgw |
| vulnerability_id |
VCID-tbtc-p1y5-qbgw |
| summary |
Serialization vulnerability
A serialization vulnerability was found in the `SocketServer` and `ServerSocketReceiver` components. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2017-5929 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.10144 |
| scoring_system |
epss |
| scoring_elements |
0.93239 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.10144 |
| scoring_system |
epss |
| scoring_elements |
0.93251 |
| published_at |
2026-06-06T12:55:00Z |
|
| 2 |
| value |
0.10144 |
| scoring_system |
epss |
| scoring_elements |
0.93255 |
| published_at |
2026-06-09T12:55:00Z |
|
| 3 |
| value |
0.10144 |
| scoring_system |
epss |
| scoring_elements |
0.93249 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.10144 |
| scoring_system |
epss |
| scoring_elements |
0.93247 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.10144 |
| scoring_system |
epss |
| scoring_elements |
0.9325 |
| published_at |
2026-06-05T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2017-5929 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
|
| fixed_packages |
|
| aliases |
CVE-2017-5929, GHSA-vmfg-rjjm-rjrj
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-tbtc-p1y5-qbgw |
|
| 70 |
| url |
VCID-tfky-edec-13gw |
| vulnerability_id |
VCID-tfky-edec-13gw |
| summary |
Deserialization of Untrusted Data
A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the `readValue` method of the `ObjectMapper`. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2017-15095 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.07891 |
| scoring_system |
epss |
| scoring_elements |
0.92164 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.07891 |
| scoring_system |
epss |
| scoring_elements |
0.92187 |
| published_at |
2026-06-09T12:55:00Z |
|
| 2 |
| value |
0.07891 |
| scoring_system |
epss |
| scoring_elements |
0.92173 |
| published_at |
2026-06-08T12:55:00Z |
|
| 3 |
| value |
0.07891 |
| scoring_system |
epss |
| scoring_elements |
0.92174 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.07891 |
| scoring_system |
epss |
| scoring_elements |
0.92177 |
| published_at |
2026-06-05T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2017-15095 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
| 27 |
|
| 28 |
|
| 29 |
|
| 30 |
|
| 31 |
|
| 32 |
|
| 33 |
|
| 34 |
|
| 35 |
|
| 36 |
|
| 37 |
|
| 38 |
|
| 39 |
|
| 40 |
|
| 41 |
|
| 42 |
|
| 43 |
|
| 44 |
|
| 45 |
|
| 46 |
|
| 47 |
|
|
| fixed_packages |
|
| aliases |
CVE-2017-15095, GHSA-h592-38cm-4ggp
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-tfky-edec-13gw |
|
| 71 |
| url |
VCID-ut6k-7z6d-zqh1 |
| vulnerability_id |
VCID-ut6k-7z6d-zqh1 |
| summary |
In Bouncy Castle JCE Provider the DSA key pair generator generates a weak private key if used with default values
In the Bouncy Castle JCE Provider version 1.55 and earlier the DSA key pair generator generates a weak private key if used with default values. If the JCA key pair generator is not explicitly initialised with DSA parameters, 1.55 and earlier generates a private value assuming a 1024 bit key size. In earlier releases this can be dealt with by explicitly passing parameters to the key pair generator. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000343 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01074 |
| scoring_system |
epss |
| scoring_elements |
0.78112 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.01074 |
| scoring_system |
epss |
| scoring_elements |
0.78138 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.01074 |
| scoring_system |
epss |
| scoring_elements |
0.78143 |
| published_at |
2026-06-09T12:55:00Z |
|
| 3 |
| value |
0.01074 |
| scoring_system |
epss |
| scoring_elements |
0.78125 |
| published_at |
2026-06-08T12:55:00Z |
|
| 4 |
| value |
0.01074 |
| scoring_system |
epss |
| scoring_elements |
0.78137 |
| published_at |
2026-06-07T12:55:00Z |
|
| 5 |
| value |
0.01074 |
| scoring_system |
epss |
| scoring_elements |
0.78146 |
| published_at |
2026-06-06T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000343 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
|
| fixed_packages |
|
| aliases |
CVE-2016-1000343, GHSA-rrvx-pwf8-p59p
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ut6k-7z6d-zqh1 |
|
| 72 |
| url |
VCID-uu4x-njt9-pbd6 |
| vulnerability_id |
VCID-uu4x-njt9-pbd6 |
| summary |
Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-14380 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00319 |
| scoring_system |
epss |
| scoring_elements |
0.55278 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00319 |
| scoring_system |
epss |
| scoring_elements |
0.55335 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00319 |
| scoring_system |
epss |
| scoring_elements |
0.55343 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00319 |
| scoring_system |
epss |
| scoring_elements |
0.55332 |
| published_at |
2026-06-09T12:55:00Z |
|
| 4 |
| value |
0.00319 |
| scoring_system |
epss |
| scoring_elements |
0.55312 |
| published_at |
2026-06-08T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-14380 |
|
| 2 |
|
| 3 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-14380
|
| risk_score |
3.4 |
| exploitability |
0.5 |
| weighted_severity |
6.8 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-uu4x-njt9-pbd6 |
|
| 73 |
| url |
VCID-wch3-d92x-sudf |
| vulnerability_id |
VCID-wch3-d92x-sudf |
| summary |
django.contrib.auth.forms.AuthenticationForm in Django 2.0 before 2.0.2, and 1.11.8 and 1.11.9, allows remote attackers to obtain potentially sensitive information by leveraging data exposure from the confirm_login_allowed() method, as demonstrated by discovering whether a user account is inactive. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-6188 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00438 |
| scoring_system |
epss |
| scoring_elements |
0.63493 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.00438 |
| scoring_system |
epss |
| scoring_elements |
0.63474 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.00438 |
| scoring_system |
epss |
| scoring_elements |
0.63486 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.00438 |
| scoring_system |
epss |
| scoring_elements |
0.63495 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.00438 |
| scoring_system |
epss |
| scoring_elements |
0.63488 |
| published_at |
2026-06-05T12:55:00Z |
|
| 5 |
| value |
0.00438 |
| scoring_system |
epss |
| scoring_elements |
0.63445 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-6188 |
|
| 2 |
|
| 3 |
|
| 4 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
| reference_url |
https://usn.ubuntu.com/3559-1 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
7.5 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
|
| 1 |
| value |
8.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
|
| 2 |
| value |
HIGH |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://usn.ubuntu.com/3559-1 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-6188, GHSA-rf4j-j272-fj86, PYSEC-2018-4
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wch3-d92x-sudf |
|
| 74 |
| url |
VCID-x5g7-7v7w-ekdy |
| vulnerability_id |
VCID-x5g7-7v7w-ekdy |
| summary |
rubygem-foreman_ansible: "User input" entry from Job Invocation may contain sensitive data |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-10716 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00156 |
| scoring_system |
epss |
| scoring_elements |
0.36135 |
| published_at |
2026-06-04T12:55:00Z |
|
| 1 |
| value |
0.00156 |
| scoring_system |
epss |
| scoring_elements |
0.36229 |
| published_at |
2026-06-05T12:55:00Z |
|
| 2 |
| value |
0.00156 |
| scoring_system |
epss |
| scoring_elements |
0.36238 |
| published_at |
2026-06-06T12:55:00Z |
|
| 3 |
| value |
0.00156 |
| scoring_system |
epss |
| scoring_elements |
0.36201 |
| published_at |
2026-06-07T12:55:00Z |
|
| 4 |
| value |
0.00156 |
| scoring_system |
epss |
| scoring_elements |
0.36162 |
| published_at |
2026-06-08T12:55:00Z |
|
| 5 |
| value |
0.00156 |
| scoring_system |
epss |
| scoring_elements |
0.36175 |
| published_at |
2026-06-09T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-10716 |
|
| 2 |
|
| 3 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-10716
|
| risk_score |
1.9 |
| exploitability |
0.5 |
| weighted_severity |
3.9 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-x5g7-7v7w-ekdy |
|
| 75 |
| url |
VCID-x61x-6b6k-h3bn |
| vulnerability_id |
VCID-x61x-6b6k-h3bn |
| summary |
An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2018-7537 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.03173 |
| scoring_system |
epss |
| scoring_elements |
0.872 |
| published_at |
2026-06-07T12:55:00Z |
|
| 1 |
| value |
0.03173 |
| scoring_system |
epss |
| scoring_elements |
0.87208 |
| published_at |
2026-06-09T12:55:00Z |
|
| 2 |
| value |
0.03173 |
| scoring_system |
epss |
| scoring_elements |
0.87196 |
| published_at |
2026-06-08T12:55:00Z |
|
| 3 |
| value |
0.03173 |
| scoring_system |
epss |
| scoring_elements |
0.87182 |
| published_at |
2026-06-04T12:55:00Z |
|
| 4 |
| value |
0.03173 |
| scoring_system |
epss |
| scoring_elements |
0.87203 |
| published_at |
2026-06-06T12:55:00Z |
|
| 5 |
| value |
0.03173 |
| scoring_system |
epss |
| scoring_elements |
0.87205 |
| published_at |
2026-06-05T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2018-7537 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
| reference_url |
https://github.com/django/django |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
2.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U |
|
| 2 |
| value |
LOW |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://github.com/django/django |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
| reference_url |
https://usn.ubuntu.com/3591-1 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
5.3 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
|
| 1 |
| value |
2.7 |
| scoring_system |
cvssv4 |
| scoring_elements |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U |
|
| 2 |
| value |
LOW |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
|
| url |
https://usn.ubuntu.com/3591-1 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
|
| fixed_packages |
|
| aliases |
CVE-2018-7537, GHSA-2f9x-5v75-3qv4, PYSEC-2018-6
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-x61x-6b6k-h3bn |
|
| 76 |
| url |
VCID-z9uf-p9w2-57fj |
| vulnerability_id |
VCID-z9uf-p9w2-57fj |
| summary |
Deserialization of Untrusted Data
FasterXML jackson-databind mishandles the interaction between serialization gadgets and typing. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-14061 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.06308 |
| scoring_system |
epss |
| scoring_elements |
0.91135 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.06308 |
| scoring_system |
epss |
| scoring_elements |
0.91119 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.06308 |
| scoring_system |
epss |
| scoring_elements |
0.91122 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.06308 |
| scoring_system |
epss |
| scoring_elements |
0.91125 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.06308 |
| scoring_system |
epss |
| scoring_elements |
0.91113 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-14061 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-14061, GHSA-c2q3-4qrh-fm48
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-z9uf-p9w2-57fj |
|
| 77 |
| url |
VCID-zbfc-s76k-gfgv |
| vulnerability_id |
VCID-zbfc-s76k-gfgv |
| summary |
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2020-10969 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01035 |
| scoring_system |
epss |
| scoring_elements |
0.77759 |
| published_at |
2026-06-09T12:55:00Z |
|
| 1 |
| value |
0.01035 |
| scoring_system |
epss |
| scoring_elements |
0.77741 |
| published_at |
2026-06-08T12:55:00Z |
|
| 2 |
| value |
0.01035 |
| scoring_system |
epss |
| scoring_elements |
0.77751 |
| published_at |
2026-06-07T12:55:00Z |
|
| 3 |
| value |
0.01035 |
| scoring_system |
epss |
| scoring_elements |
0.77761 |
| published_at |
2026-06-06T12:55:00Z |
|
| 4 |
| value |
0.01035 |
| scoring_system |
epss |
| scoring_elements |
0.77754 |
| published_at |
2026-06-05T12:55:00Z |
|
| 5 |
| value |
0.01035 |
| scoring_system |
epss |
| scoring_elements |
0.77726 |
| published_at |
2026-06-04T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2020-10969 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
| 16 |
|
| 17 |
|
| 18 |
|
| 19 |
|
| 20 |
|
| 21 |
|
| 22 |
|
| 23 |
|
| 24 |
|
| 25 |
|
| 26 |
|
|
| fixed_packages |
|
| aliases |
CVE-2020-10969, GHSA-758m-v56v-grj4
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zbfc-s76k-gfgv |
|
| 78 |
| url |
VCID-zkjk-uddk-9qem |
| vulnerability_id |
VCID-zkjk-uddk-9qem |
| summary |
In Bouncy Castle JCE Provider ECDSA does not fully validate ASN.1 encoding of signature on verification
In the Bouncy Castle JCE Provider version 1.55 and earlier ECDSA does not fully validate ASN.1 encoding of signature on verification. It is possible to inject extra elements in the sequence making up the signature and still have it validate, which in some cases may allow the introduction of 'invisible' data into a signed structure. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000342 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00471 |
| scoring_system |
epss |
| scoring_elements |
0.64994 |
| published_at |
2026-06-05T12:55:00Z |
|
| 1 |
| value |
0.00471 |
| scoring_system |
epss |
| scoring_elements |
0.64951 |
| published_at |
2026-06-04T12:55:00Z |
|
| 2 |
| value |
0.00471 |
| scoring_system |
epss |
| scoring_elements |
0.64998 |
| published_at |
2026-06-09T12:55:00Z |
|
| 3 |
| value |
0.00471 |
| scoring_system |
epss |
| scoring_elements |
0.6498 |
| published_at |
2026-06-08T12:55:00Z |
|
| 4 |
| value |
0.00471 |
| scoring_system |
epss |
| scoring_elements |
0.64992 |
| published_at |
2026-06-07T12:55:00Z |
|
| 5 |
| value |
0.00471 |
| scoring_system |
epss |
| scoring_elements |
0.65004 |
| published_at |
2026-06-06T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2016-1000342 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
| 13 |
|
| 14 |
|
| 15 |
|
|
| fixed_packages |
|
| aliases |
CVE-2016-1000342, GHSA-qcj7-g2j5-g7r3
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-zkjk-uddk-9qem |
|