Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.1LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing th…EPSS 0.3%Oct 12, 2026
- Medium5.4An **incorrect authorization** flaw has been found in **network interface handling** in the **Foreman** package.EPSS 0.2%Oct 12, 2026
- Medium5.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could haveEPSS 0.2%Oct 12, 2026
- Medium5.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 19.2.8, all 19.3 versions, and 19.4 before 19.4.2 that, under certain conditions, could haveEPSS 0.2%Oct 12, 2026
- High8.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could haveEPSS 0.2%Oct 12, 2026
- Medium5.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could haveEPSS 0.2%Oct 12, 2026
- High8.2Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private a…EPSS 0.3%Oct 11, 2026
- High8.7SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take…EPSS 0.3%Oct 10, 2026
- Medium4.3Contao: Improper access control in the table access voterEPSS 0.2%Oct 9, 2026
- Medium6.4MariaDB server is a community developed fork of MySQL server.EPSS 0.5%Oct 9, 2026
- High7.2Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Incorrect Authorization vulnerability.EPSS 0.3%Oct 9, 2026
- High7.1PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypassOct 8, 2026
- High7.4AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy loginsEPSS 0.2%Oct 8, 2026
- Medium6.5IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a local attacker to obta…EPSS 0.1%Oct 8, 2026
- Medium4.3In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted loo…EPSS 0.2%Oct 7, 2026
- Medium5.3Incorrect authorization in Omnibox in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain sensitive infor…EPSS 0.2%Oct 6, 2026
- Medium6.1Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access rest…EPSS 0.2%Oct 6, 2026
- High8.8Incorrect authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via a crafted HTML page.EPSS 0.3%Oct 6, 2026
- High8.8Incorrect authorization in WebProtect in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information v…EPSS 0.3%Oct 6, 2026
- Medium5.3Payload is a free and open source headless content management system.EPSS 0.2%Oct 6, 2026
- Critical9.3Payload is a free and open source headless content management system.EPSS 0.2%Oct 6, 2026
- High7.8A flaw was found in sudo.EPSS 0.1%Sep 23, 2026
- Medium5.3An access control vulnerability was discovered in the Smart Polling configuration functionality due to insufficient validation of user privileges.EPSS 0.4%Sep 8, 2026
- Medium6.4An access control vulnerability was discovered in the Credentials Manager functionality due to insufficient validation of user privileges.EPSS 0.4%Sep 8, 2026
- Medium6.5Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain an Incorrect Authorization vulnerability in the REST API.EPSS 0.4%Sep 3, 2026