Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.9Pode is a Cross-Platform PowerShell web framework for creating REST APIs, Web Sites, and TCP/SMTP servers.May 14, 2026
- Medium5.3Gotenberg is a Docker-powered stateless API for PDF files.May 14, 2026
- High8.4STIGQter is an open-source reimplementation of DISA's STIG Viewer.May 14, 2026
- Medium6.5The Media Sync plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.9 via the 'sub_dir' and 'media_items' parameters.May 14, 2026
- Medium5.7ERPNext is a free and open source Enterprise Resource Planning tool.May 13, 2026
- Medium6.9The Angular SSR is a server-rise rendering tool for Angular applications.May 13, 2026
- Medium5.3Nitro is a next generation server toolkit.May 13, 2026
- Medium4.4Flight is an extensible micro-framework for PHP.May 13, 2026
- Medium6.0Hermes WebUI prior to 0.51.44 contains a path traversal vulnerability in the session import endpoint that allows authenticated attackers to read arbitrary files by imp…EPSS 0.4%May 13, 2026
- High8.6A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud Storage devices that could allow a remote authenticated user to move…May 13, 2026
- Medium6.9A directory traversal vulnerability exists in BIG-IP SSL Orchestrator that allows an authenticated attacker with high privilege to overwrite, delete or corrupt arbitra…May 13, 2026
- Medium6.5A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_generator.cpp does not perform…May 13, 2026
- High7.2An authenticated iControl REST user with low privileges can create or modify arbitrary files through an undisclosed iControl REST endpoint on the BIG-IQ system.EPSS 0.4%May 13, 2026
- High8.7Joomla com_fabrik 3.9.11 contains a directory traversal vulnerability that allows unauthenticated attackers to list arbitrary files by manipulating the folder parameter.EPSS 0.7%May 13, 2026
- High7.2Heym before 0.0.21 contains a path traversal vulnerability in the file upload endpoint that allows authenticated users to write attacker-controlled files to arbitrary…May 12, 2026
- High8.7Mako is a template library written in Python.May 12, 2026
- Medium6.2Hugo is a static site generator.May 12, 2026
- Critical9.9django-s3file is a lightweight file upload input for Django and Amazon S3.May 12, 2026
- High8.8HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client host through a path traversal attack.May 12, 2026
- Critical9.3Pulpy is a lightweight, cross-platform desktop application packager for web apps.May 12, 2026
- High8.7Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Limitation of a Pathname to a Restrict…May 12, 2026
- Medium6.3Substance3D - Designer versions 15.1.0 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that…May 12, 2026
- Critical9.6Langflow is a tool for building and deploying AI-powered agents and workflows.May 12, 2026
- Medium5.5Relative path traversal in Visual Studio Code allows an unauthorized attacker to disclose information locally.May 12, 2026
- Medium4.3A tampering vulnerability exists when .NET Core improperly handles specially crafted files.May 12, 2026