Catalog

Findings

Filter the merged record by severity, source, stack, and weakness type.

SearchSeveritySourceStackWeaknessSort

Known exploited only

Reset

Medium6.9Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access…CVE-2026-109323 · CVE.org · NIST NVDOct 12, 2026
Medium5.3Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll.CVE-2026-109319 · CVE.org · NIST NVDOct 12, 2026
Medium6.9Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the c…CVE-2026-109316 · CVE.org · NIST NVDOct 12, 2026
High7.1jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey…CVE-2026-109187 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 12, 2026
Medium5.3yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calli…CVE-2026-109172 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 12, 2026
Medium5.3A vulnerability was identified in yangzongzhuan RuoYi 4.8.3.CVE-2026-108800 · CVE.org · NIST NVDOct 12, 2026
Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to del…CVE-2026-108885 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 11, 2026
Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify lo…CVE-2026-108880 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 11, 2026
Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify us…CVE-2026-108875 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 11, 2026
Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to…CVE-2026-108870 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 11, 2026
Medium5.3UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary app…CVE-2026-108855 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 11, 2026
Low2.3CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export fil…CVE-2026-108745 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 11, 2026
Medium5.3Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read link…CVE-2026-108734 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.3%Oct 11, 2026
Medium5.3CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data int…CVE-2026-108705 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 11, 2026
High7.11Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/…CVE-2026-108700 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 11, 2026
High7.11Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking…CVE-2026-108692 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 11, 2026
Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendT…CVE-2026-108680 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 10, 2026
Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated user…CVE-2026-108675 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 10, 2026
Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to…CVE-2026-108670 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 10, 2026
Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates.CVE-2026-108665 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 10, 2026
Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT /sys/tenant/updateApplyStatus.CVE-2026-108660 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 10, 2026
Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to r…CVE-2026-108655 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 10, 2026
Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrie…CVE-2026-108651 · CVE.org · NIST NVDOct 10, 2026
Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to…CVE-2026-108650 · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%Oct 10, 2026
Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import ca…CVE-2026-108646 · CVE.org · NIST NVDOct 10, 2026