Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- UnknownMalicious code in @beloved-lenora/opencode-goal (npm)Open the advisoryOct 16, 2026
- UnknownMalicious code in @beloved-lenora/opencode-btw (npm)Open the advisoryOct 16, 2026
- UnknownCVE-2026-89098 affecting package nfs-utils 2.6.4-4Open the advisoryOct 16, 2026
- High8.7LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins…Open the advisoryOct 16, 2026
- High8.2Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated attackers to retrieve payme…Open the advisoryOct 16, 2026
- Low2.3tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by supplying unescaped cookie…Open the advisoryOct 16, 2026
- Medium5.1tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard valida…Open the advisoryOct 16, 2026
- Medium5.3WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to access other agents' tickets…Open the advisoryOct 16, 2026
- Critical9.3LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-T…Open the advisoryOct 16, 2026
- Medium6.3Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans by supplying a raw openid c…Open the advisoryOct 16, 2026
- Medium6.9qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow integration endpoints perm…Open the advisoryOct 16, 2026
- Medium5.3Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope.Open the advisoryOct 16, 2026
- High7.2Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device ce…Open the advisoryOct 16, 2026
- Medium5.3Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockou…Open the advisoryOct 16, 2026
- Medium4.8Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded.Check if you run itEPSS 0.13%Oct 16, 2026
- Medium6.8Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count.Open the advisoryOct 16, 2026
- Medium5.3Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint.Open the advisoryOct 16, 2026
- High7.1ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerIn…Open the advisoryOct 16, 2026
- Medium4.8Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/upd…Open the advisoryOct 16, 2026
- Medium6.9Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/ord…Open the advisoryOct 16, 2026
- Medium5.3FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups bec…Open the advisoryOct 16, 2026
- High7.1Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access priv…Open the advisoryOct 16, 2026
- Medium6.9Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-…Open the advisoryOct 16, 2026
- High8.6bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by…Open the advisoryOct 16, 2026
- High8.6Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to…Open the advisoryOct 16, 2026