Findings
High and critical vulnerabilities in our tools, worst first. Medium and low ones are stored too; switch on "All severities" or search a tool to see them.
| Vulnerability | Tool | Severity | Chance of attack (EPSS) | Fix | Status |
|---|---|---|---|---|---|
| Exploited CVE-2026-111497 A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1 |
Node.js 22.16.0 App / API |
Critical 9.8 | 83% (top 1%) |
22.23.4, 24.22.1, 26.12.1 | New |
| Exploited CVE-2023-38180 .NET and Visual Studio Denial of Service Vulnerability |
.NET 6 runtime 6.* App / API |
High 7.5 | 14% (top 3%) |
6.0.21, 7.0.10 | New |
| Exploited CVE-2023-44487 The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. |
.NET 6 runtime 6.* App / API |
High 7.5 | 100% (top 1%) |
6.0.23, 7.0.12 | New |