Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium4.3The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, a…EPSS 0.2%Oct 14, 2026
- Medium5.3Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability.EPSS 0.3%Oct 14, 2026
- Medium4.3The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authen…EPSS 0.2%Oct 14, 2026
- Medium5.3The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing un…EPSS 0.2%Oct 14, 2026
- Critical9.8Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' ParameterEPSS 0.4%Oct 13, 2026
- High8.6Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right r…EPSS 0.3%Oct 13, 2026
- High8.7Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify…EPSS 0.5%Oct 13, 2026
- Medium5.3Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation resul…EPSS 0.3%Oct 13, 2026
- Medium5.3The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1.EPSS 0.3%Oct 13, 2026
- High7.1fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenti…EPSS 0.3%Oct 13, 2026
- Medium5.3Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by…EPSS 0.3%Oct 13, 2026
- High8.6FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify o…EPSS 0.3%Oct 13, 2026
- Medium5.3Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' da…EPSS 0.2%Oct 13, 2026
- High7.1Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and d…EPSS 0.3%Oct 13, 2026
- Low2.3RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings…EPSS 0.3%Oct 13, 2026
- Medium5.3Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by…EPSS 0.2%Oct 13, 2026
- Medium6.9Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.EPSS 0.1%Oct 13, 2026
- Medium5.3Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by…EPSS 0.2%Oct 13, 2026
- Low3.1A flaw was found in Quay.EPSS 0.2%Oct 12, 2026
- Medium5.3Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory IDOct 12, 2026
- Critical9.1Thirty bees through 1.7.0 Account Takeover via PasswordController Guest CheckoutOct 12, 2026
- Medium5.3MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files…EPSS 0.2%Oct 12, 2026
- Medium5.3TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite othe…EPSS 0.2%Oct 12, 2026
- Medium5.3TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/it…EPSS 0.2%Oct 12, 2026
- Medium6.9Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the…EPSS 0.3%Oct 11, 2026