Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.5MaxKB is an open-source AI assistant for enterprise.May 26, 2026
- Medium6.9Kavita is a cross platform reading server.May 26, 2026
- Critical9.8FACTION is a PenTesting Report Generation and Collaboration Framework.May 26, 2026
- High8.1FastNetMon Community Edition through 1.2.9 exposes a gRPC API server on port 50052 with no authentication mechanism.May 26, 2026
- Low2.9A security vulnerability has been detected in ItzCrazyKns Vane up to 1.12.1.May 24, 2026
- Critical10.0A missing authentication vulnerability exists in the Altium 365 SearchService.May 21, 2026
- Critical9.3Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web configuration interface that allows unauthenti…May 20, 2026
- High8.6Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases.May 20, 2026
- Critical10.0A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthenticated, remote attacker to access site resources with t…May 20, 2026
- High8.8In ScadaBR version 1.2.0, a Missing Authentication for Critical Function vulnerability could allow an unauthenticated attacker to send a HTTP GET requests to the SCADA…May 19, 2026
- Medium6.5Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the re…May 19, 2026
- Critical9.1API endpoints in LalanaChami Pharmacy Management System (commit 5c3d028) lack authentication middleware.May 19, 2026
- Critical9.3WordPress Plugin Peugeot Music 1.0 contains an arbitrary file upload vulnerability that allows unauthenticated attackers to upload malicious files by sending POST requ…May 17, 2026
- Critical9.3GitBucket 4.23.1 contains an unauthenticated remote code execution vulnerability that allows attackers to execute arbitrary commands by exploiting weak secret token ge…May 17, 2026
- Medium5.5A weakness has been identified in Sanluan PublicCMS 5.202506.d.May 17, 2026
- Medium5.3Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.May 15, 2026
- Medium6.9Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows unauthenticated attackers t…May 14, 2026
- Critical9.4Gradient is a nix-based continuous integration system.May 14, 2026
- High7.8DevSpace is a client-only developer tool for cloud-native development with Kubernetes.May 14, 2026
- Medium6.3Missing authentication in the KVM key download endpoint could allow an unauthenticated attacker with knowledge of the exposed URL to retrieve sensitive keys, potential…May 14, 2026
- High7.3The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed.May 13, 2026
- Medium5.9Multiple authorization bypass vulnerabilities in the Endpoint DLP component of Prisma Access Agent® allow a local attacker to bypass authentication controls and execut…May 13, 2026
- High8.8ChurchCRM is an open-source church management system.May 12, 2026
- Medium6.1Fides is an open-source privacy engineering platform.May 12, 2026
- Medium5.3The mem0 1.0.0 server lacks authentication and authorization controls for its memory creation API endpoint (POST /memories).May 12, 2026