Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.5Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perf…Oct 14, 2026
- Medium6.9A weakness has been identified in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449.Oct 14, 2026
- Medium5.4FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.Oct 14, 2026
- High7.2InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.Oct 14, 2026
- Medium5.3InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.Oct 14, 2026
- Critical9.3Redash is a package for data visualization and sharing.Oct 14, 2026
- High7.8mise manages dev tools like node, python, cmake, and terraform.Oct 14, 2026
- UnknownGitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository…Oct 14, 2026
- Medium4.3Gitea's repository markup endpoint resolves same-repository pull request references without enforcing the viewer's Pull Requests permission.Oct 14, 2026
- Medium4.3Gitea's user SSH and GPG key-list API endpoints omit the profile visibility check applied by their web equivalents.Oct 14, 2026
- Medium4.3Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners.Oct 14, 2026
- Medium4.3Gitea's activity-feed and contribution-heatmap API handlers do not apply the profile visibility check for restricted accounts viewing Limited-visibility users.Oct 14, 2026
- Medium6.5For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution.Oct 14, 2026
- Medium4.3Gitea's package registry grants authenticated users read access to packages owned by Limited-visibility users without excluding restricted accounts.Oct 14, 2026
- Medium4.3Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated with the requesting user.Oct 14, 2026
- High8.1Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement.Oct 14, 2026
- Medium5.3The WPCode WordPress plugin before 2.4.0 does not correctly verify that a request is genuinely for the login screen before entering its snippet safe mode, allowing una…Oct 14, 2026
- Medium5.3The Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant WordPress plugin before 5.3.2 does not perform a nonce or capabil…EPSS 0.2%Oct 14, 2026
- Medium6.5The Trust Payments Gateway for WooCommerce WordPress plugin before 3.1.0 does not verify the authenticity of the payment provider's response when a customer returns fr…EPSS 0.2%Oct 14, 2026
- Medium5.3The EmbedPress WordPress plugin before 4.6.8 does not perform any capability or nonce check on an unauthenticated request that triggers a server-side, credential-beari…EPSS 0.2%Oct 14, 2026
- High8.6A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthori…EPSS 0.3%Oct 14, 2026
- Medium5.3A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to acces…EPSS 0.3%Oct 14, 2026
- Medium5.3A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device.EPSS 0.3%Oct 14, 2026
- High8.2IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install.EPSS 0.2%Oct 13, 2026
- Medium4.9Improper access control in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.EPSS 0.9%Oct 13, 2026
134 records · page 1 of 6
PreviousNext