Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.3The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.0.Apr 15, 2026
- Medium5.3The e-shot™ form builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.2.Apr 15, 2026
- Medium5.3The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0.Apr 15, 2026
- Medium5.3The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabili…EPSS 0.9%Apr 15, 2026
- Critical9.3Jellyfin is an open source self hosted media server.Apr 14, 2026
- Medium5.3The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect function in all versions up t…EPSS 0.2%Apr 14, 2026
- High8.1A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR on-premise 7.6.0 through 7.6.3, F…Apr 14, 2026
- Medium4.3The Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) plugin for WordPress is vulnerable to unauthorized access of data due to a improper ca…Apr 14, 2026
- Critical9.1The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the function in all versions up to, and including,…Apr 14, 2026
- Medium6.5Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remote functi…Apr 14, 2026
- High7.1Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP report to ove…Apr 14, 2026
- Medium6.5Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker could update and delete child entities via exp…Apr 14, 2026
- Medium6.5Due to missing authorization checks in the SAP S/4HANA backend OData Service (Manage Reference Structures), an attacker could update and delete child entities via expo…Apr 14, 2026
- Medium6.5Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Reference Equipment), an attacker could update and delete child entities via OData service…Apr 14, 2026
- Medium4.3Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Technical Object Structures), an attacker could update and delete child entities via expos…Apr 14, 2026
- Medium4.9Due to a missing authorization check, SAP S/4HANA (Private Cloud and On-Premise) allows an authenticated user to delete files on the operating system and gain unauthor…Apr 14, 2026
- Medium4.3The Material Master application does not enforce authorization checks for authenticated users when executing reports, resulting in the disclosure of sensitive information.Apr 14, 2026
- Low1.7Craft Commerce is an ecommerce platform for Craft CMS.Apr 13, 2026
- Low2.1A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1.Apr 12, 2026
- Medium5.4The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and including, 3.9.7.Apr 11, 2026
- Critical9.3goshs is a SimpleHTTPServer written in Go.Apr 10, 2026
- Medium6.5TREK is a collaborative travel planner.Apr 10, 2026
- Medium6.5Chamilo LMS is a learning management system.Apr 10, 2026
- Medium6.5Chamilo LMS is a learning management system.Apr 10, 2026
- Medium5.3OpenClaw before 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing leaf subagents to message controlled child sessions beyond their authorized scope.Apr 10, 2026