Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium4.3The Emailchef plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the page_options_ajax_disconnect() function…EPSS 0.3%Apr 22, 2026
- Critical9.8The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and including, 1.0.20.Apr 22, 2026
- Medium4.3The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1.Apr 22, 2026
- Critical9.1The Create DB Tables plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.1.Apr 22, 2026
- Medium5.3The CalJ plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.Apr 22, 2026
- High7.1The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowing authenticated remote attackers to arbitrarily read database contents through a speci…Apr 22, 2026
- Medium5.3Craft CMS is a content management system (CMS).Apr 22, 2026
- High7.5Decidim is a participatory democracy framework.Apr 21, 2026
- High7.1FreeScout is a free self-hosted help desk and shared mailbox.Apr 21, 2026
- Medium5.9FreeScout is a free self-hosted help desk and shared mailbox.Apr 21, 2026
- Medium5.7FreeScout is a free self-hosted help desk and shared mailbox.Apr 21, 2026
- Medium4.3The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.2.1.Apr 21, 2026
- High8.8Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user can immedi…Apr 21, 2026
- Medium5.3OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-bearing HTTP modes.Apr 21, 2026
- Medium5.3Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high lev…Apr 20, 2026
- High7.5Vexa is an open-source, self-hostable meeting bot API and meeting transcription API.Apr 20, 2026
- Low2.1A security vulnerability has been detected in ComfyUI up to 0.13.0.Apr 20, 2026
- High8.1ChurchCRM is an open-source church management system.Apr 18, 2026
- High7.1ChurchCRM is an open-source church management system.Apr 18, 2026
- High8.8Movary is a self hosted web app to track and rate a user's watched movies.Apr 18, 2026
- High7.6wger is a free, open-source workout and fitness manager.Apr 17, 2026
- Medium5.3Anviz CX7 Firmware is vulnerable to the most recently captured test photo that can be retrieved without authentication, revealing sensitive operational imagery.Apr 17, 2026
- Medium5.3Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information about the dep…Apr 17, 2026
- Medium5.3Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g., SSH/RTTY status), assisting attackers in reconnaissan…Apr 17, 2026
- Medium4.3The Canto plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.1.1.Apr 17, 2026