VIGIE VULN · VULNERABILITY INTELLIGENCE
Search CVEs, advisories, packages
All the data you need for dependency audits, hosted here in Europe, ready to export and use directly with VigieVuln.
415 559Published vulnerabilities
307 064Advisories
Data updates : CVE List (cvelistV5) · CISA KEV · EPSS (FIRST.org) · ENISA EUVD · CERT-FR (ANSSI) · NVD (fkie-cad mirror) · OSV.dev
Libraries recently hit by a critical vulnerability
- mlflow PyPI
3.12.0rc0 – < 3.17.0CRITICAL 9.8 CWE-94 Code Injection +1CVE-2026-116692 28 critical CVEs - praisonai PyPI
4.2.1 – < 4.6.59CRITICAL 9.8 CWE-200 Exposure of Sensitive Information to an Unauthorized Actor +2CVE-2026-57116 32 critical CVEs - github.com/bytebase/bytebase Go
< 1.0.1CRITICAL 9.3 CWE-290 Authentication Bypass by SpoofingCVE-2022-51026 - litellm PyPI
1.91.0 – < 1.100.4 ; 1.101.0 – < 1.101.3 ; 1.102.0 – < 1.102.2 ; …CRITICAL 9.9 CWE-269 Improper Privilege Management +2CVE-2026-114612 8 critical CVEs - better-auth npm
1.4.0-beta.18 – < 1.7.7CRITICAL 9.1 CWE-287 Improper AuthenticationCVE-2026-114607 7 critical CVEs - brotli PyPI
1.0.3 – < 1.2.1CRITICAL 9.2 CWE-787 Out-of-bounds Write +1CVE-2026-111497 2 critical CVEs - brotlicffi PyPI
1.0.3 – < 1.2.1.0CRITICAL 9.2 CWE-787 Out-of-bounds Write +1CVE-2026-111497 - mem0ai PyPI
0.1.117 – < 1.0.8CRITICAL 9.2 CWE-89 SQL InjectionCVE-2026-115324 - laravel/framework Packagist
13.0.0 – < 13.29.0 ; < 12.68.0CRITICAL 9.2 CWE-287 Improper Authentication +1CVE-2026-114509 - pillow PyPI
11.0.0 – < 13.0.0CRITICAL 9.8 CWE-125 Out-of-bounds Read +1CVE-2026-96639 16 critical CVEs
Most likely to be exploited
- CVE-2026-109619 CRITICAL 9.2 KEVPHP Group PHP
8.2.* – < 8.2.35 ; 8.3.* – < 8.3.36 ; 8.4.* – < 8.4.27 ; …RCE via stale global state - CVE-2026-109618 CRITICAL 9.2 KEVPHP Group PHP
8.2.* – < 8.2.35 ; 8.3.* – < 8.3.36 ; 8.4.* – < 8.4.27 ; …RCE via OOM corruption - CVE-2025-53770 CRITICAL 9.8 KEVMicrosoft Microsoft SharePoint Enterprise Server 2016
16.0.0 – < 16.0.5513.1001
+2 moreMicrosoft SharePoint Server Remote Code Execution Vulnerability - CVE-2024-7593 CRITICAL 9.8 KEVIvanti vTM
fixed in 22.7R2, 22.2R1Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 … - CVE-2024-3400 CRITICAL 10.0 KEVPalo Alto Networks PAN-OS
10.2.0 – < 10.2.9-h1 ; 11.0.0 – < 11.0.4-h1 ; 11.1.0 – < 11.1.2-h3
+2 morePAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect - CVE-2024-23897 CRITICAL 9.8 KEVorg.jenkins-ci.main/jenkins-core Maven
1.606 – < 2.426.3 ; 2.427 – < 2.440.1 ; 2.441 – < 2.442Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser tha… - CVE-2024-21893 HIGH 8.2 KEVIvanti ICS
9.1R18 ; 22.6R2
+1 moreA server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and … - CVE-2024-21887 CRITICAL 9.1 KEVIvanti ICS
9.1R18 ; 22.6R2
+1 moreA command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy … - CVE-2023-4966 CRITICAL 9.4 KEVCitrix NetScaler ADC
14.1 – < 8.50 ; 13.1 – < 49.15 ; 13.0 – < 92.19 ; …
+1 moreUnauthenticated sensitive information disclosure - CVE-2023-44487 HIGH 7.5 KEVgolang.org/x/net Go
< 0.17.0
+10 moreThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation c…
Recently added to CISA KEV
- CVE-2026-48356 CRITICAL 9.3 KEVAdobe Adobe Commerce
≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
+3 moreAdobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) - CVE-2026-111497 CRITICAL 9.2 KEVbrotli PyPI
1.0.3 – < 1.2.1
+1 moreOut-of-Bounds Write in Google Brotli Decoder - CVE-2026-109619 CRITICAL 9.2 KEVPHP Group PHP
8.2.* – < 8.2.35 ; 8.3.* – < 8.3.36 ; 8.4.* – < 8.4.27 ; …RCE via stale global state - CVE-2026-109618 CRITICAL 9.2 KEVPHP Group PHP
8.2.* – < 8.2.35 ; 8.3.* – < 8.3.36 ; 8.4.* – < 8.4.27 ; …RCE via OOM corruption - CVE-2026-114625 CRITICAL 9.4 KEVArista Networks VeloCloud Orchestrator
5.2.0 – < 5.2.3.18 ; 6.1.0 – < 6.1.3.10 ; 6.4.0 – < 6.4.2.12Security Advisory 0199 - CVE-2026-110447 CRITICAL 9.2 KEVCollabora Collabora Online - Built-in CODE Server
< 26.4.303Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote c… - CVE-2026-96656 HIGH 8.6 KEVPlex Media Server
< 1.43.3.10861Plex Media Server arbitrary file write - CVE-2026-96655 MEDIUM 5.3 KEVPlex Media Server
< 1.43.3.10861Plex Media Server arbitrary-host SSRF - CVE-2026-96654 MEDIUM 6.9 KEVPlex Media Server
< 1.43.3.10861Plex Media Server URL injection - CVE-2026-96652 MEDIUM 5.3 KEVPlex Media Server
< 1.43.3.10861Plex Media Server SSRF
Public data, traceable sources
CVE records and NVD scores, OSV/GHSA package advisories and CERT-FR publications, brought together in one place.
CISA KEV, ENISA and EPSS add exploitation context. Each record links to its sources and licences.