Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium4.3A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on…EPSS 0.6%May 28, 2026
- Medium4.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditi…EPSS 0.3%May 28, 2026
- Critical10.0free5GC is an open-source implementation of the 5G core network.EPSS 0.4%May 27, 2026
- Medium5.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could havEPSS 0.5%May 27, 2026
- Medium5.5A security vulnerability has been detected in SourceCodester eDoc Doctor Appointment System 1.0.May 26, 2026
- High8.7Snipe-IT is an IT asset/license management system.May 26, 2026
- Critical9.8IBM Engineering Lifecycle Management 7.0.3, 7.1.0, and 7.2.0 could allow an unauthenticated remote attacker to update server property files that would allow them to ga…May 26, 2026
- Medium5.3Traccar is an open source GPS tracking system.May 26, 2026
- High7.2The affected products insufficiently verify authorization when deleting user accounts.May 26, 2026
- Medium5.5A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16.May 24, 2026
- High8.7Redaxo CMS Mediapool Addon 5.5.1 and older contains an arbitrary file upload vulnerability that allows authenticated users to bypass file extension blacklist restrictions.May 23, 2026
- High8.8The Docker CLI --use-api-socket flag bypasses Enhanced Container Isolation (ECI) restrictions in Docker Desktop.May 22, 2026
- High7.1authentik is an open-source identity provider.May 22, 2026
- Medium6.5TypeBot is a chatbot builder tool.May 22, 2026
- Medium5.4Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to validate the OAuth token scope on the callback which allows an au…May 22, 2026
- Critical10.0Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the…May 22, 2026
- High7.5Concrete CMS 9.5.0 and below is vulnerable to missing authorization in the bulk_user_assignment.php which can lead to privilege escalation to Administrative Group.May 21, 2026
- High8.7LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint.May 21, 2026
- High8.7LiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit.May 21, 2026
- Medium4.3Mattermost versions 11.5.x <= 11.5.1 fail to validate team-level run_create permission against the target team when creating a playbook run which allows an authenticat…May 21, 2026
- Medium6.5In Splunk AI Toolkit versions below 5.7.3, a low-privileged user that does not hold the 'admin' or 'power' roles could access confidential data that was restricted thr…May 20, 2026
- Medium5.7Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks.May 19, 2026
- Medium5.3Mantis Bug Tracker (MantisBT) is an open source issue tracker.May 19, 2026
- Medium5.3In the AWS Secrets Manager and SSM Parameter Store secrets backends of prior to 9.28.0, the team-scoping logic could resolve a containing a (e.g.May 19, 2026
- High8.2LIVE555 before 2026.04.22 contains an authorization bypass vulnerability in RTSP session command handling that allows attackers to replay valid Session tokens from una…May 19, 2026