Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Critical10.0Widget Factory Joomla Content Editor Improper Access Control VulnerabilityKEVEPSS 16.2%Jun 5, 2026
- Critical9.3The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.EPSS 0.4%May 27, 2026
- Critical10.0Ubiquiti UniFi OS Improper Access Control VulnerabilityKEVEPSS 15.2%May 21, 2026
- Medium5.3Improper Access Control vulnerability in Apache OFBiz in multi-tenant deployments.EPSS 0.5%May 19, 2026
- Low2.1A flaw has been found in Kilo-Org kilocode up to 7.0.47.EPSS 0.3%May 17, 2026
- Medium5.5A weakness has been identified in h2oai h2o-3 up to 7402.EPSS 0.5%May 17, 2026
- Medium5.5A vulnerability was identified in h2oai h2o-3 up to 7402.EPSS 0.5%May 17, 2026
- Medium5.3Improper access control between the Joint Test Action Group (JTAG) and Advanced Extensible Interface (AXI) could allow an attacker with physical access to read or over…EPSS 0.1%May 15, 2026
- High8.8An access issue was addressed with additional sandbox restrictions.EPSS 0.1%May 12, 2026
- High7.2Due to not validating the organization context when executing adaptive authentication flows, the WSO2 Identity Server allows adaptive authentication logic to be trigge…EPSS 0.4%May 11, 2026
- Critical9.9Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php.May 8, 2026
- Critical9.6Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.EPSS 0.4%Apr 23, 2026
- Medium6.5An issue in the Bluetooth Low Energy (BLE) control interface of the Yamaha SR-B30A sound bar firmware 2.40 (Mobile App: Sound Bar Remote / version: 2.40) allows remote…Apr 16, 2026
- Critical10.0The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers t…Apr 16, 2026
- Low3.1Insufficient policy enforcement in CORS in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-origi…Apr 15, 2026
- Low3.1Insufficient policy enforcement in Passwords in Google Chrome prior to 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to leak cross-…Apr 15, 2026
- Low3.1Weblate is a web based localization tool.Apr 15, 2026
- High7.5Incorrect access control in the config.php component of Slah v1.5.0 and below allows unauthenticated attackers to access sensitive information, including active sessio…Apr 15, 2026
- Medium4.3In Splunk Enterprise versions below 10.2.2, 10.0.5, 9.4.10, and 9.3.11, and Splunk Cloud Platform versions below 10.4.2603.0, 10.3.2512.6, 10.2.2510.10, 10.1.2507.19,…Apr 15, 2026
- Medium5.5Improper access control in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information locally.Apr 14, 2026
- Medium4.4Improper access control in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.Apr 14, 2026
- High7.8Improper access control in Microsoft Management Console allows an authorized attacker to elevate privileges locally.EPSS 0.3%Apr 14, 2026
- High7.8Improper access control in Windows RPC API allows an authorized attacker to elevate privileges locally.Apr 14, 2026
- Medium6.8October is a Content Management System (CMS) and web platform.Apr 14, 2026
- Medium5.5Improper access control in Universal Plug and Play (upnp.dll) allows an authorized attacker to disclose information locally.EPSS 0.4%Apr 14, 2026