Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Critical9.2A specific endpoint exposes all user account information for registered Gardyn users without requiring authentication.Apr 3, 2026
- Critical9.8In mlflow/mlflow, the FastAPI job endpoints under are not protected by authentication or authorization when the app is enabled.EPSS 4.4%Apr 3, 2026
- High7.5Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network.Apr 3, 2026
- Critical9.2HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote att…EPSS 0.5%Apr 2, 2026
- Critical9.2OneUptime is an open-source monitoring and observability platform.Apr 2, 2026
- Critical9.1OneUptime is an open-source monitoring and observability platform.Apr 2, 2026
- Medium6.9Signal K Server is a server application that runs on a central hub in a boat.Apr 2, 2026
- Medium6.3SEPPmail Secure Email Gateway before version 15.0.3 allows an attacker with access to a victim's GINA account to bypass a second-password check and read protected emails.Apr 2, 2026
- Medium5.5A vulnerability was detected in vanna-ai vanna up to 2.0.2.Apr 2, 2026
- Low3.3HCL BigFix Platform is affected by insufficient authentication.EPSS 0.1%Apr 2, 2026
- Critical9.8Cr*nMaster (cronmaster) is a Cronjob management UI with human readable syntax, live logging and log history for cronjobs.Apr 1, 2026
- High7.5A non-default configuration in Sage DPW 2025_06_004 allows unauthenticated access to diagnostic endpoints within the Database Monitor feature, exposing sensitive infor…EPSS 0.3%Apr 1, 2026
- Medium6.9OpenViking versions 0.2.5 prior to 0.2.14 contain a missing authentication vulnerability in the bot proxy router that allows remote unauthenticated attackers to access…Apr 1, 2026
- Critical10.0A vulnerability was identified in Juju from version 3.2.0 until 3.6.19 and from version 4.0 until 4.0.4, where the internal Dqlite database cluster fails to perform pr…Apr 1, 2026
- High7.5WWBN AVideo is an open source video platform.Mar 31, 2026
- High7.5WWBN AVideo is an open source video platform.Mar 31, 2026
- Critical9.3The MAVLink communication protocol does not require cryptographic authentication by default.EPSS 0.9%Mar 31, 2026
- Critical9.3The MS27102A Remote Spectrum Monitor is vulnerable to an authentication bypass that allows unauthorized users to access and manipulate its management interface.Mar 31, 2026
- Medium5.9Sliver is a command and control framework that uses a custom Wireguard netstack.Mar 31, 2026
- High7.7Nhost is an open source Firebase alternative with GraphQL.Mar 31, 2026
- Critical10.0FastGPT is an AI Agent building platform.Mar 31, 2026
- Critical9.8Nginx UI is a web user interface for the Nginx web server.Mar 30, 2026
- High7.1Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2_TE and V6.0.10P3N3_TE allows unauthenticated attackers on the local network t…Mar 30, 2026
- Medium6.9A vulnerability was detected in PromtEngineer localGPT up to 4d41c7d1713b16b216d8e062e51a5dd88b20b054.Mar 28, 2026
- High8.6SIPP 3.3 contains a stack-based buffer overflow vulnerability that allows local unauthenticated attackers to execute arbitrary code by supplying malicious input in the…EPSS 0.2%Mar 28, 2026