Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import ca…Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes vi…EPSS 0.2%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations.EPSS 0.2%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments.Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any auth…EPSS 0.2%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify department permiss…EPSS 0.2%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to…Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sy…EPSS 0.2%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizat…Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete or…EPSS 0.3%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete A…Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to d…EPSS 0.3%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates.Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates.EPSS 0.2%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records.Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates.EPSS 0.2%Oct 10, 2026
- Medium4.3Contao: Improper access control in the preview links moduleEPSS 0.2%Oct 9, 2026
- Medium5.3ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows via POST /workflow/del/{uuid}.EPSS 0.2%Oct 9, 2026
- Medium5.3Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured…EPSS 0.2%Oct 9, 2026
- Medium6.5Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.Oct 8, 2026
- HighHazelcast has an authorization bypass in IMap Predicates APIEPSS 0.4%Oct 8, 2026
- High7.1PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypassOct 8, 2026
- Medium4.3In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway…EPSS 0.2%Oct 7, 2026
- Medium4.2Missing authorization in Translate in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation…EPSS 0.2%Oct 6, 2026
- High8.4Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially execute arb…EPSS 0.1%Oct 6, 2026