Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.1Kirby is an open-source content management system.May 9, 2026
- Medium5.3Kirby is an open-source content management system.May 9, 2026
- Medium4.3PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command.May 9, 2026
- Critical9.3SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the new GINA UI, allowing unauthenticated remote at…May 8, 2026
- High7.5The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1 through 2.8.0.May 8, 2026
- High8.6Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01.00.26.May 8, 2026
- Low3.3Kimai is an open-source time tracking application.May 8, 2026
- Medium5.3Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels.May 7, 2026
- Medium5.3Missing Authorization vulnerability in WProyal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.May 7, 2026
- Medium5.3Missing Authorization vulnerability in Magepeople inc.EPSS 0.2%May 7, 2026
- Medium6.5The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0.May 7, 2026
- Medium6.5Admidio is an open-source user management solution.May 7, 2026
- Medium6.5The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.6.10.6.May 7, 2026
- Medium5.3The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1.May 7, 2026
- Medium6.0OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay.May 6, 2026
- Medium4.9OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforcement.May 6, 2026
- Medium6.0OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permissions to per…May 6, 2026
- High7.1OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through browser act/evaluate interactions.May 6, 2026
- Critical9.2OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser session credentials.May 6, 2026
- Medium4.3A vulnerability in the RADIUS Policy API endpoints of Cisco ISE could allow an authenticated, remote attacker with read-only Administrator privileges to gain unauthori…EPSS 0.2%May 6, 2026
- Medium4.3A vulnerability in the log file download functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to download arbitrary log files from…EPSS 0.2%May 6, 2026
- Medium4.3The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to unauthorized database table creation due to missing authorization checks on the functi…May 6, 2026
- Medium6.5The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83.May 6, 2026
- Medium5.3The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_image' Woo…May 6, 2026
- Medium5.3Vaultwarden is a Bitwarden-compatible server written in Rust.May 5, 2026