Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium4.3The Blog2Social – Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 9.1.4.Oct 15, 2026
- Medium6.1n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying…Oct 14, 2026
- High7.1n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSONOct 14, 2026
- Medium6.1n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create EndpointOct 14, 2026
- High7.5In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check.Oct 14, 2026
- Medium5.4FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.Oct 14, 2026
- High8.1Plane is an open-source project management tool.Oct 14, 2026
- Medium6.5Plane is an open-source project management tool.Oct 14, 2026
- High8.2OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests.Oct 14, 2026
- High7.6InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.Oct 14, 2026
- High7.1InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.Oct 14, 2026
- High7.2InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates.Oct 14, 2026
- Medium5.3lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that…Oct 14, 2026
- High7.1Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_accessOct 14, 2026
- Medium6.0Blinko through 1.8.8 Private Attachment Read via /api/file RouteOct 14, 2026
- Medium5.3Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field.Oct 14, 2026
- Medium6.0AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/downloadOct 14, 2026
- High8.1ServiceNext contains an insecure direct object reference (IDOR) in the /api/Usuario/GetUsuarios endpoint, which accepts a user-controlled numeric ID in the request bod…Oct 14, 2026
- UnknownGitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository…Oct 14, 2026
- Medium6.1Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ow…Oct 14, 2026
- High7.1youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint.Oct 14, 2026
- Medium6.0REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership.Oct 14, 2026
- Medium5.3BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows au…Oct 14, 2026
- Medium5.3The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record befo…EPSS 0.2%Oct 14, 2026
- Medium5.3The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns t…EPSS 0.2%Oct 14, 2026
80 records · page 1 of 4
PreviousNext