Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.1Payload is a free and open source headless content management system.EPSS 0.2%Oct 6, 2026
- Critical9.8Payload is a free and open source headless content management system.EPSS 0.4%Oct 6, 2026
- High7.1Payload is a free and open source headless content management system.EPSS 0.2%Oct 6, 2026
- Medium6.5vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied featuresEPSS 0.3%Oct 5, 2026
- High8.7Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8EPSS 0.4%Oct 5, 2026
- Medium6.5A flaw was found in the automation-controller notification subsystem.Sep 23, 2026
- Medium5.3UVdesk core-framework before 1.1.7 contains an authorization bypass vulnerability in the saved reply endpoint that allows authenticated agents to access replies restri…EPSS 0.3%Sep 21, 2026
- Critical10.0Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.EPSS 0.8%Sep 3, 2026
- Medium5.4A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter.EPSS 0.2%Aug 27, 2026
- Medium6.3Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another cu…EPSS 0.4%Aug 21, 2026
- High8.7Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as…EPSS 0.4%Aug 21, 2026
- Medium5.3Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token cou…EPSS 0.2%Aug 21, 2026
- Medium5.3Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and a…Aug 21, 2026
- Critical9.3Headroom's LLM proxy derives the memory owner from the x-headroom-user-id request header.Aug 21, 2026
- High8.7Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transa…Aug 21, 2026
- Medium4.3OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve SearchEPSS 0.2%Jul 24, 2026
- High7.7OpenRemote has Cross-Realm User Information Disclosure in UserResourceImplEPSS 0.3%Jul 6, 2026
- High8.4Langflow Authorization Bypass Through User-Controlled Key VulnerabilityKEVEPSS 0.9%Jun 23, 2026
- High8.2GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that, under certain conditions, could haveEPSS 0.5%May 27, 2026
- High8.8code100x contains an authentication bypass vulnerability in the Mobile API that allows unauthenticated attackers to impersonate arbitrary users by supplying a crafted…May 26, 2026
- Medium5.9Kavita is a cross platform reading server.May 26, 2026
- Low3.1Bugsink is a self-hosted error tracking tool.May 26, 2026
- Low3.1Bugsink is a self-hosted error tracking tool.May 26, 2026
- Medium6.5e107 is a content management system (CMS).May 26, 2026
- Medium4.3An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ONLYOFFICE DocSpace before 3.2.1.May 26, 2026