Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.3OutSystems Lifetime is vulnerable to Authorization Bypass Through User-Controlled Key vulnerability in ApplicationID parameter.May 25, 2026
- Low2.9A security vulnerability has been detected in QuantumNous new-api up to 0.12.1.May 23, 2026
- High8.8Authorization bypass through user-controlled key in Azure Privileged Identity Management (PIM) allows an authorized attacker to elevate privileges over a network.May 22, 2026
- High7.1TypeBot is a chatbot builder tool.May 22, 2026
- Low3.1TypeBot is a chatbot builder tool.May 22, 2026
- Medium6.5Typebot is a chatbot builder tool.May 22, 2026
- Low2.6Authorization bypass in the entry duplication feature in Devolutions Server allows an authenticated user with write access to any vault to copy documentation and attac…May 22, 2026
- Low2.3Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in the Express association Reorder dialog.May 22, 2026
- High7.1Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate file ownership and access control, which allows an authe…May 22, 2026
- High7.5The AudioIgniter plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2.May 22, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys.May 21, 2026
- Low2.3Concrete CMS 9.5.0 and below is vulnerable to IDOR in AddMessage/UpdateMessage via attachments[] parameter which can lead to file permission bypass.May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is subject to Insecure Direct Object Reference (IDOR) in the Express Entry Detail block via the exEntryID parameter.May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to authorization Bypass in the Calendar Event Frontend Dialog which can allow cross-calendar data disclosure.May 21, 2026
- High8.7LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit.May 21, 2026
- High7.5Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd.EPSS 0.3%May 21, 2026
- High8.1(Externally Controlled Reference to a Resource in Another Sphere), (Authorization Bypass Through User-Controlled Key) vulnerability in Apache Camel K.May 21, 2026
- Critical10.0A missing authentication vulnerability exists in the Altium 365 SearchService.May 21, 2026
- Medium4.3The Broadstreet plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.52.2 via the get_sponsored_meta AJAX act…EPSS 0.2%May 21, 2026
- High8.3A vulnerability was identified in the ShadowAttribute proposal creation workflow.May 20, 2026
- High8.1A flaw was found in Keycloak.May 20, 2026
- Low2.3Authorization Bypass Through User-Controlled Key vulnerability in phenixdigital phoenix_storybook allows cross-session PubSub topic injection via a URL query parameter.May 20, 2026
- Medium4.3The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 4.2.0.May 20, 2026
- Medium6.5The Oliver POS – A WooCommerce Point of Sale (POS) plugin for WordPress is vulnerable to Authorization Bypass Through User-Controlled Key in all versions up to and inc…May 20, 2026
- Critical9.3Sparx Pro Cloud Server requires authentication based on requested URL.May 19, 2026