Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.5WeKnora is an LLM-powered framework designed for deep document understanding and semantic retrieval.Mar 7, 2026
- High8.5Plane is an an open-source project management tool.Mar 6, 2026
- Critical9.3Wekan is an open source kanban tool built with Meteor.Mar 6, 2026
- High7.7Lemmy, a link aggregator and forum for the fediverse, is vulnerable to server-side request forgery via a dependency on activitypub_federation, a framework for Activity…Mar 6, 2026
- Medium4.3melange allows users to build apk packages using declarative pipelines.Mar 6, 2026
- Critical9.3Ghostfolio is an open source wealth management software.Mar 6, 2026
- High8.2OpenSift is an AI study tool that sifts through large datasets using semantic search and generative AI.Mar 6, 2026
- Critical9.2Idno is a social publishing platform.Mar 6, 2026
- Medium6.3OpenClaw versions prior to 2026.2.14 contain a server-side request forgery vulnerability in the optional Tlon Urbit extension that accepts user-provided base URLs for…Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.2 contain a server-side request forgery vulnerability in attachment and media URL hydration that allows remote attackers to fetch arb…Mar 5, 2026
- Medium6.3OpenClaw versions prior to 2026.2.14 contain server-side request forgery vulnerabilities in the Feishu extension that allow attackers to fetch attacker-controlled remo…Mar 5, 2026
- Medium5.0Twenty is an open source CRM.Mar 5, 2026
- High7.5An Arbitrary File Read vulnerability exists in the ImageTextPromptValue class in Exploding Gradients RAGAS v0.2.3 to v0.2.14.EPSS 0.6%Mar 5, 2026
- Medium6.4Server-Side Request Forgery (SSRF) vulnerability in SkatDesign Ratatouille ratatouille allows Server Side Request Forgery.This issue affects Ratatouille: from n/a through <= 1.2.6.Mar 5, 2026
- High7.7A Server-Side Request Forgery (SSRF) vulnerability was identified in the @opennextjs/cloudflare package, resulting from a path normalization bypass in the /cdn-cgi/ima…Mar 4, 2026
- High7.2The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and…EPSS 0.3%Mar 4, 2026
- Medium4.3HomeBox is a home inventory and organization system.Mar 3, 2026
- Medium6.5ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI.EPSS 0.2%Mar 2, 2026
- High7.7Chamilo is a learning management system.EPSS 0.4%Mar 2, 2026
- Medium5.3Chamilo is a learning management system.EPSS 0.3%Mar 2, 2026
- High8.6Statmatic is a Laravel and Git powered content management system (CMS).Feb 27, 2026
- Medium5.3Featured Image from Content (featured-image-from-content) WordPress plugin versions prior to 1.7 contain an authenticated server-side request forgery vulnerability tha…Feb 27, 2026
- High8.6Gradio is an open-source Python package designed for quick prototyping.Feb 27, 2026
- Medium6.5Kiteworks is a private data network (PDN).Feb 27, 2026
- High7.5An XML External Entity (XXE) vulnerability allows malicious user to perform Server-Side Request Forgery (SSRF) via crafted XML input containing malicious external enti…Feb 27, 2026