Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attackers to write files to disk…Check if you run itEPSS 0.42%Oct 12, 2026
- Medium5.3LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to th…Open the advisoryOct 12, 2026
- Medium5.3LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs…Check if you run itEPSS 0.18%Oct 12, 2026
- High8.7LogicalDOC Community Edition through 9.3 contains a code injection vulnerability that allows authenticated users to execute OS commands by submitting Velocity template…Open the advisoryOct 12, 2026
- High7.4In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without e…Check if you run itEPSS 0.17%Oct 12, 2026
- Medium6.5In Progress ShareFile Storage Zones Controller v5.12.6 and below, improper validation of outbound request destinations and parameters, unsafe JSONP response formatting…Check if you run itEPSS 0.24%Oct 12, 2026
- High7.1jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey…Check if you run itEPSS 0.25%Oct 12, 2026
- High8.7jshERP through 3.6 contains a mass assignment vulnerability in the UserController update handler that allows authenticated users to overwrite protected fields includin…Open the advisoryOct 12, 2026
- Medium5.3jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restriction…Check if you run itEPSS 0.21%Oct 12, 2026
- Medium5.3jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users restricted to personal or department data to list other users' bills…Open the advisoryOct 12, 2026
- Medium5.3MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files…Check if you run itEPSS 0.20%Oct 12, 2026
- Medium5.3yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calli…Check if you run itEPSS 0.20%Oct 12, 2026
- Medium5.3TDuck survey form through 6.0 contains an insecure direct object reference vulnerability in the saveFormTheme handler that allows authenticated users to overwrite othe…Check if you run itEPSS 0.19%Oct 12, 2026
- Medium5.3TDuck survey form through 6.0 contains a broken access control vulnerability that allows authenticated users to add fields to other users' forms via POST /user/form/it…Check if you run itEPSS 0.24%Oct 12, 2026
- High7.1LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing th…Check if you run itEPSS 0.30%Oct 12, 2026
- Medium6.9Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers to downl…Open the advisoryOct 12, 2026
- Unknownhex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25Check if you run itEPSS 0.24%Oct 12, 2026
- Low1.2A vulnerability was determined in Zen Cart up to 2.2.2.Check if you run itEPSS 0.33%Oct 12, 2026
- UnknownInternal error terms inspected into AshTypescript RPC error responsesCheck if you run itEPSS 0.32%Oct 12, 2026
- Medium6.9A vulnerability was detected in Kamailio up to 6.0.7/6.1.3.Check if you run itEPSS 0.77%Oct 12, 2026
- Low2.1A weakness has been identified in agno-agi agno up to 3.0.6/3.1.1.Check if you run itEPSS 0.27%Oct 12, 2026
- UnknownMalicious code in pyyi (PyPI)Open the advisoryOct 12, 2026
- UnknownMalicious code in minecraftaccfinder (PyPI)Open the advisoryOct 12, 2026
- Medium5.5A vulnerability was identified in agno-agi agno up to 2.7.3/3.0.6.Check if you run itEPSS 0.53%Oct 12, 2026
- Critical9.1Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed.Check if you run itEPSS 0.30%Oct 12, 2026