Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium4.3Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' ParametersOct 15, 2026
- High8.1Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment IDOct 15, 2026
- High8.7IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNodeOct 15, 2026
- High7.5Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perf…Oct 14, 2026
- High7.5In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check.Oct 14, 2026
- High8.2FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations.Oct 14, 2026
- Medium6.5Plane is an open-source project management tool.Oct 14, 2026
- High8.2OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests.Oct 14, 2026
- Critical9.2Dgraph is an open source distributed GraphQL database.Oct 14, 2026
- Medium5.6Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents.Oct 14, 2026
- Medium5.3GrowChief through 0.3.0 Missing Authorization via /users/all-users EndpointOct 14, 2026
- Medium5.3Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk UpdateOct 14, 2026
- High8.2WordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerabilityOct 14, 2026
- High8.8Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.Oct 14, 2026
- Medium6.5Zulip is an open-source team collaboration tool.Oct 14, 2026
- High7.5Discourse is an open-source discussion platform.Oct 14, 2026
- High7.1VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire…Oct 14, 2026
- Low2.3Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying…Oct 14, 2026
- High7.7Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by…Oct 14, 2026
- High7.7Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management a…Oct 14, 2026
- High8.7Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects…Oct 14, 2026
- Medium6.3we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to downlo…Oct 14, 2026
- High7.1jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change oth…Oct 14, 2026
- High7.7Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or works…Oct 14, 2026
- High8.7Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or una…Oct 14, 2026
164 records · page 1 of 7
PreviousNext