Catalog
Findings
Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.
- Medium6.9FreeRDP before 3.32.0 NULL Dereference via Zero-Length WebSocket PingEPSS 0.2%Oct 16, 2026
- UnknownMalicious code in xmd-baileys (npm)Oct 16, 2026
- UnknownMalicious code in @developmentyora/yorakids (npm)Oct 16, 2026
- UnknownMalicious code in @developmentyora/baileyss (npm)Oct 16, 2026
- UnknownMalicious code in asistenyorstore (npm)Oct 16, 2026
- UnknownMalicious code in @celestial-community/baileys (npm)Oct 16, 2026
- High7.0A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local auth…Oct 16, 2026
- High7.2The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Si…Oct 16, 2026
- Medium6.4Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer RoleOct 16, 2026
- High7.2The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter i…Oct 16, 2026
- Medium4.3Arcane: Environment access token bypasses the admin-required authorization gate onOct 16, 2026
- High8.8Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)Oct 16, 2026
- High7.2The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versions up to…Oct 16, 2026
- Medium6.5The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14.1.Oct 16, 2026
- Low3.1ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)Oct 16, 2026
- Low3.7CoreDNS headless AXFR can emit an empty transfer batch that panics the pluginEPSS 0.5%Oct 16, 2026
- Medium6.5Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destinationEPSS 0.2%Oct 16, 2026
- UnknownRank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious CodeOct 16, 2026
- Critical9.8The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.KEVEPSS 0.4%Oct 16, 2026
- High7.5sync 2026-10-16T15:41:51ZEPSS 0.3%Oct 16, 2026
- High7.5JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoSEPSS 0.3%Oct 16, 2026
- High7.0A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.EPSS 0.3%Oct 15, 2026
- High7.1BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed docum…EPSS 0.2%Oct 15, 2026
- High7.1CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders v…EPSS 0.2%Oct 15, 2026
- Medium5.3SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other work…EPSS 0.3%Oct 15, 2026