Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.8In Eclipse Jetty, across various versions of , and , the Jakarta Spec authoritative url-pattern rules for mixed annotation, and defined on the same were not being appl…Oct 15, 2026
- High8.5Rancher users who can create Projects can gain access to arbitrary projectsOct 15, 2026
- Medium5.3ApostropheCMS before 4.33.0 allows authentication bypass for REST API page reading, as demonstrated by a /api/v1/@apostrophecms/page?all=1 call.Oct 15, 2026
- High7.1Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id FieldOct 14, 2026
- Critical9.0Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placing env inside a shared preset.Oct 14, 2026
- High7.2n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node ParametersOct 14, 2026
- High7.2n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-WorkflowsOct 14, 2026
- UnknownAn improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, potentially allowing a remote…Oct 14, 2026
- Medium6.3bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ign…Oct 14, 2026
- High7.5Discourse is an open-source discussion platform.Oct 14, 2026
- UnknownGitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository…Oct 14, 2026
- UnknownGitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account.Oct 14, 2026
- Medium4.3Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request.Oct 14, 2026
- Medium6.5Gitea's shared comparison helper omits the token repository-access check used when updating pull requests.Oct 14, 2026
- Medium5.4Gitea's repository migration API accepts a public-only token when the request specifies creation of a private repository.Oct 14, 2026
- UnknownGitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes.Oct 14, 2026
- Medium4.3Gitea's user organization-list API includes Limited-visibility organizations for authenticated restricted accounts without applying the visibility restriction enforced…Oct 14, 2026
- Medium6.5Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdmin…Oct 14, 2026
- High7.0VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestric…Oct 14, 2026
- High7.5Incorrect Authorization vulnerability in Progress MOVEit Transfer (Client Certificates module).Oct 14, 2026
- High8.8Gitea fork workflow approval bypass through review eventsOct 14, 2026
- Medium5.3The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission befor…EPSS 0.2%Oct 14, 2026
- Medium4.3Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.EPSS 0.1%Oct 14, 2026
- Critical10.0Adobe Experience Manager | Incorrect Authorization (CWE-863)EPSS 0.7%Oct 13, 2026
- Critical9.9Adobe Experience Manager | Incorrect Authorization (CWE-863)EPSS 0.6%Oct 13, 2026
139 records · page 1 of 6
PreviousNext