Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.2The WooCommerce PayPal Payments plugin for WordPress is vulnerable to unauthorized order manipulation and information disclosure due to missing authorization checks on…May 23, 2026
- High8.7An authentication logic vulnerability in multiple TP-Link range extenders allows an unauthenticated attacker on an adjacent network to manipulate a login parameter and…May 22, 2026
- Low3.1TypeBot is a chatbot builder tool.May 22, 2026
- High8.4Missing input source validation in the tool authorization prompt in Kiro CLI before 1.28.0 allows a local attacker to execute arbitrary tools, including shell commands…May 22, 2026
- Critical10.0Typebot is a chatbot builder tool.May 22, 2026
- Medium5.4Missing authorization in the entry status management feature in Devolutions Server allows a non-administrator authenticated user to bypass the administrator-enforced P…May 22, 2026
- Medium4.3Improper access control in the entry documentation and attachment features in Devolutions Server allows an authenticated user with vault read access to retrieve the do…May 22, 2026
- Medium4.3Missing authorization in the user profile update feature in Devolutions Server allows an authenticated Active Directory user to modify their own profile attributes via…May 22, 2026
- High7.5The Ditty – Responsive News Tickers, Sliders, and Lists plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.65.May 22, 2026
- Medium4.3The Vedrixa Forms – User Registration Form, Signup Form & Drag & Drop Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, an…May 22, 2026
- Medium5.3The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1.May 22, 2026
- Medium5.4A broken access control vulnerability exists in the TeamViewer DEX Platform (On‑Premises) prior version 9.2.May 22, 2026
- Medium4.3The Location Weather plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the and functions in all versions up t…May 22, 2026
- High7.5There is an an information disclosure vulnerability in ZTE MU5250.May 22, 2026
- Medium4.3The FastX theme for WordPress is vulnerable to unauthorized limited plugin installation and activation due to missing capability checks on the 'ultp_install_callback'…May 22, 2026
- Critical9.1The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it.May 22, 2026
- Critical9.1The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag.May 22, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to IDOR.May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to IDOR.May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to IDOR.May 21, 2026
- Medium6.3Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate.May 21, 2026
- Medium6.3In Concrete CMS 9.5.0 and below, the submit_password() method in concrete/controllers/single_page/download_file.php allows unauthorized file access since downloading p…May 21, 2026
- Medium4.3The GSheet For Woo Importer plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the process_ajax_restore_action() func…May 21, 2026
- Medium6.5Missing Authorization vulnerability in VillaTheme HAPPY allows Exploiting Incorrectly Configured Access Control Security Levels.May 21, 2026
- Medium5.3Missing Authorization vulnerability in Tobias CF7 WOW Styler allows Exploiting Incorrectly Configured Access Control Security Levels.May 21, 2026