Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium4.8The GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up to, and including, 2.9.May 12, 2026
- Medium5.3The Smart Appointment & Booking plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and a nonce validation logic…May 12, 2026
- Medium4.3The Rate Star Review Vote - AJAX Reviews, Votes, Star Ratings plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4.May 12, 2026
- High8.2Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.May 12, 2026
- Medium4.3Due to insufficient authorization checks in the SAP Incentive and Commission Management application, authenticated users could invoke a remote-enabled function module…May 12, 2026
- Medium6.3Due to missing authorization check in SAP S/4HANA Condition Maintenance, an authenticated attacker could gain unauthorized access to view and modify condition table re…May 12, 2026
- Medium5.4Due to missing authorization check in SAP Strategic Enterprise Management (Scorecard Wizard in Business Server Pages), an authenticated attacker could access informati…May 12, 2026
- High7.7WWBN AVideo is an open source video platform.May 11, 2026
- Medium5.5An authorization issue was addressed with improved state management.EPSS 0.1%May 11, 2026
- Medium6.0OpenClaw before 2026.4.20 contains a guard bypass vulnerability in the agent-facing gateway config.patch and config.apply endpoints that fails to protect operator-trus…May 11, 2026
- Medium6.3OpenClaw before 2026.4.22 contains an authentication bypass vulnerability in the Control UI bootstrap config endpoint that allows unauthenticated attackers to read sen…May 11, 2026
- High8.9Bitwarden Server prior to v2026.4.0 contains a missing authorization vulnerability that allows a provider service user to add an arbitrary organization to their provid…May 11, 2026
- Medium5.3Bitwarden Server prior to v2026.4.1 contains a missing authorization vulnerability that allows any authenticated user to write ciphers into an arbitrary organization v…May 11, 2026
- High7.5In Meari IoT Cloud alert image storage on Alibaba OSS (latest observed; storage service version not disclosed), motion snapshots are retrievable without authentication…May 11, 2026
- High7.5In Meari client applications embedding "com.meari.sdk" (including CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label <= 1.8.x), the integrated…May 11, 2026
- Critical9.4Grav is a file-based Web platform.May 11, 2026
- High8.8Dell Automation Platform versions prior to 2.0.0.0, contains a missing authorization vulnerability.May 11, 2026
- Critical9.3WordPress TheCartPress 1.5.3.6 contains an unauthenticated privilege escalation vulnerability that allows attackers to create administrator accounts by submitting craf…EPSS 0.4%May 10, 2026
- Low2.1A security vulnerability has been detected in osTicket up to 1.18.3.May 9, 2026
- Critical9.4phpVMS is a PHP application to run and simulate an airline.May 9, 2026
- Medium5.3A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmental information via direc…EPSS 0.2%May 9, 2026
- High8.7Arcane is an interface for managing Docker containers, images, networks, and volumes.May 9, 2026
- High8.5Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes.May 9, 2026
- Medium5.3Kirby is an open-source content management system.May 9, 2026
- High7.1Kirby is an open-source content management system.May 9, 2026