Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.3Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by…EPSS 0.2%Oct 13, 2026
- Medium6.9Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation.EPSS 0.1%Oct 13, 2026
- Medium5.3Froxlor before 2.3.14 contains an insecure direct object reference vulnerability in the email template editor (admin_templates.php) because the mail body is fetched by…EPSS 0.2%Oct 13, 2026
- High8.5Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations.EPSS 0.3%Oct 12, 2026
- Medium5.3Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an expli…EPSS 0.3%Oct 12, 2026
- Low3.1A flaw was found in Quay.EPSS 0.2%Oct 12, 2026
- Medium6.4A flaw was found in Red Hat Quay.EPSS 0.2%Oct 12, 2026
- Medium5.3Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory IDEPSS 0.2%Oct 12, 2026
- Critical9.1Thirty bees through 1.7.0 Account Takeover via PasswordController Guest CheckoutEPSS 0.3%Oct 12, 2026
- Medium5.3MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files…EPSS 0.2%Oct 12, 2026
- Medium5.3TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite othe…EPSS 0.2%Oct 12, 2026
- Medium5.3TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/it…EPSS 0.2%Oct 12, 2026
- Medium6.5A flaw has been found in **permission filters** in the **foreman** package.EPSS 0.2%Oct 12, 2026
- Medium5.3A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206.EPSS 0.2%Oct 12, 2026
- Medium6.9Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the…EPSS 0.3%Oct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the…EPSS 0.2%Oct 10, 2026
- Medium4.3Contao: Improper access control in the preview links moduleEPSS 0.2%Oct 9, 2026
- High7.1Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in AWS Amplify API Category before 3.1.2 might allow an authenticated…EPSS 0.3%Oct 9, 2026
- High8.8Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability.EPSS 0.2%Oct 9, 2026
- High8.8Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Authorization Bypass Through User-Controlled Key vulnerability.EPSS 0.2%Oct 9, 2026
- Low2.3An authenticated Ops Manager user with a read-only project role can retrieve a daily host monitoring record associated with a different project when they possess the r…Oct 9, 2026
- Medium4.3In Splunk Enterprise versions below 10.4.3, 10.2.7, and 10.0.10, a user that holds a role with the edit_spl2_module_permissions capability could use the affected Repre…EPSS 0.2%Oct 7, 2026
- Medium6.5In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could use a user-controlled job i…EPSS 0.2%Oct 7, 2026
- HighLangflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource HandlersEPSS 0.2%Oct 7, 2026
- High7.1Payload is a free and open source headless content management system.EPSS 0.2%Oct 6, 2026