Catalog
Findings
Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.
- Medium4.3Incorrect access control in Kaleris YMS v7.2.2.1 allows authenticated attackers with only the shipping/receiving role to view the truck's dashboard resources.EPSS 0.3%Apr 6, 2026
- High8.1The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference…Apr 4, 2026
- Critical9.3A specific endpoint allows authenticated users to pivot to other user profiles by modifying the id number in the API call.EPSS 0.3%Apr 3, 2026
- Medium4.3** UNSUPPORTED WHEN ASSIGNED ** Focalboard version 8.0 fails to validate file ownership when serving uploaded files.EPSS 0.3%Apr 3, 2026
- Medium6.5Scoold is a Q&A and a knowledge sharing platform for teams.EPSS 0.5%Apr 2, 2026
- Medium5.4listmonk is a standalone, self-hosted, newsletter and mailing list manager.EPSS 0.3%Apr 2, 2026
- Medium5.5A vulnerability was identified in SourceCodester Leave Application System 1.0.Apr 2, 2026
- Low2.9A vulnerability was determined in Cesanta Mongoose up to 7.20.Apr 2, 2026
- Low2.3A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster.Apr 1, 2026
- Medium4.3The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Insecure Direct Object Reference i…EPSS 0.3%Mar 31, 2026
- High7.1OpenClaw before 2026.3.11 contains an authorization bypass vulnerability allowing channel commands to mutate protected sibling-account configuration despite configWrit…EPSS 0.3%Mar 31, 2026
- High7.0Insecure Direct Object Reference (IDOR) vulnerability in 1millionbot Millie chat that allows private conversations of other users being viewed by simply changing the c…Mar 31, 2026
- Critical9.9Nginx UI is a web user interface for the Nginx web server.EPSS 0.4%Mar 30, 2026
- High8.7A vulnerability of authorization bypass through user-controlled key in the 'console-survey/api/v1/answer/{EVENTID}/{TIMESTAMP}/' endpoint.EPSS 0.4%Mar 30, 2026
- High7.5The Download Monitor plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.7 via the executePayment() functi…EPSS 0.4%Mar 30, 2026
- High8.2MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients.EPSS 0.5%Mar 27, 2026
- High8.7Langflow is a tool for building and deploying AI-powered agents and workflows.EPSS 0.7%Mar 27, 2026
- Medium5.3LibreChat is a ChatGPT clone with additional features.EPSS 0.3%Mar 27, 2026
- Low1.3A vulnerability has been found in OpenBMB XAgent 1.0.0.Mar 27, 2026
- Medium4.3WWBN AVideo is an open source video platform.EPSS 0.3%Mar 27, 2026
- Medium5.3WWBN AVideo is an open source video platform.EPSS 0.4%Mar 27, 2026
- Critical9.3Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authentication bypass.EPSS 0.5%Mar 27, 2026
- High7.4MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypass in the endpoint allows attackers with low-pri…EPSS 0.6%Mar 27, 2026
- Medium6.5Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework.EPSS 0.4%Mar 27, 2026
- Medium4.3Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.EPSS 0.3%Mar 27, 2026