Catalog
Findings
Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.
- Medium5.5A security vulnerability has been detected in jsbroks COCO Annotator up to 0.11.1.EPSS 0.6%May 3, 2026
- High8.1The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference…EPSS 0.5%May 2, 2026
- High8.6School App developed by Zyosoft has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modify a specific parameter to read a…EPSS 0.4%May 2, 2026
- Medium5.3The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 5.6.0.EPSS 0.5%May 2, 2026
- Low2.1A vulnerability was determined in OWAP DefectDojo up to 2.55.4.EPSS 0.4%Apr 30, 2026
- Low2.1A security vulnerability has been detected in LinkStackOrg LinkStack up to 4.8.6.EPSS 0.4%Apr 30, 2026
- High8.1IBM Langflow OSS 1.0.0 through 1.8.4 could allow any user to supply a flow_id to read transaction logs and vertex build data belonging to other users, and to delete pe…EPSS 0.4%Apr 30, 2026
- High7.5IBM Langflow Desktop 1.0.0 through 1.8.4 Langflow could allow an unauthenticated user to view other users' images due to an indirect object reference through a user-controlled key.EPSS 0.4%Apr 30, 2026
- High8.1Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts.EPSS 0.4%Apr 30, 2026
- High8.1Authorization bypass through User-Controlled key vulnerability in MeWare Software Development Inc.EPSS 0.4%Apr 30, 2026
- High7.1This vulnerability exists in e-Sushrut due to the use of reversible Base64 encoding for protecting sensitive data.EPSS 0.4%Apr 29, 2026
- High7.1This vulnerability exists in e-Sushrut due to improper authorization checks during resource access.EPSS 0.4%Apr 29, 2026
- High7.1This vulnerability exists in e-Sushrut due to improper access control in resource access validation.EPSS 0.4%Apr 29, 2026
- High7.7Outline is a service that allows for collaborative documentation.EPSS 0.4%Apr 28, 2026
- Low2.3OpenClaw before 2026.3.31 contains a sender allowlist bypass vulnerability that allows remote attackers to access restricted messages.EPSS 0.4%Apr 28, 2026
- Critical9.8NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass thr…EPSS 0.6%Apr 28, 2026
- Medium6.9OpenClaw before 2026.4.2 fails to normalize trailing-dot localhost hosts in remote CDP discovery responses, allowing bypass of loopback protections.EPSS 0.4%Apr 28, 2026
- High7.3A weak key generation vulnerability exists in specific firmware versions of Milesight AIOT cameras allows authorization to be bypassed.EPSS 0.3%Apr 27, 2026
- Medium5.3A weakness has been identified in mettle sendportal up to 3.0.1.EPSS 0.4%Apr 27, 2026
- Low2.1A security flaw has been discovered in 1000 Projects Portfolio Management System MCA 1.0.EPSS 0.4%Apr 27, 2026
- Medium5.3Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS applicationEPSS 0.2%Apr 27, 2026
- Medium5.3The Booking Calendar Contact Form plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.63 via the dex_bccf_…EPSS 0.4%Apr 24, 2026
- Medium5.3The MaxiBlocks Builder plugin for WordPress is vulnerable to arbitrary media file deletion due to insufficient file ownership validation on the 'maxi_remove_custom_ima…EPSS 0.3%Apr 24, 2026
- Medium4.3Xibo is an open source digital signage platform with a web content management system and Windows display player software.EPSS 0.3%Apr 24, 2026
- High8.7A vulnerability in SpiceJet’s booking API allows unauthenticated users to query passenger name records (PNRs) without any access controls.EPSS 0.4%Apr 23, 2026