Catalog
Findings
Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.
- Medium6.5Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destinationEPSS 0.2%Oct 16, 2026
- UnknownRank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious CodeOct 16, 2026
- Critical9.8The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc.KEVEPSS 0.4%Oct 16, 2026
- High7.5sync 2026-10-16T15:41:51ZEPSS 0.3%Oct 16, 2026
- High7.5JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoSEPSS 0.3%Oct 16, 2026
- High7.0A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain unauthorized device access.EPSS 0.3%Oct 15, 2026
- High7.1BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed docum…EPSS 0.2%Oct 15, 2026
- High7.1CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders v…EPSS 0.2%Oct 15, 2026
- Medium5.3SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attach subscribers to other work…EPSS 0.3%Oct 15, 2026
- Critical9.1MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts.EPSS 0.3%Oct 15, 2026
- Medium5.3zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataScope restrictions by supplyi…EPSS 0.3%Oct 15, 2026
- Low2.3crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers.EPSS 0.3%Oct 15, 2026
- Medium5.3Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by sup…EPSS 0.2%Oct 15, 2026
- High8.7ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin R…EPSS 0.4%Oct 15, 2026
- Low2.3metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass rol…EPSS 0.2%Oct 15, 2026
- Low2.3Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer…EPSS 0.3%Oct 15, 2026
- Medium6.9Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records vi…EPSS 0.3%Oct 15, 2026
- Medium5.3Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other cu…EPSS 0.2%Oct 15, 2026
- Medium5.3ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' commen…EPSS 0.2%Oct 15, 2026
- Medium5.3Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id.EPSS 0.3%Oct 15, 2026
- Medium5.3APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a…EPSS 0.3%Oct 15, 2026
- Medium5.3pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /ad…EPSS 0.3%Oct 15, 2026
- Medium6.3OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added.EPSS 0.3%Oct 15, 2026
- Medium5.3Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to man…EPSS 0.3%Oct 15, 2026
- High8.2JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in servic…EPSS 0.2%Oct 15, 2026