Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.3Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting thCheck this weekEPSS 55.00%Oct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendT…Check if you run itEPSS 0.19%Oct 10, 2026
- High7.1JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any use…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated user…Check if you run itEPSS 0.19%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to r…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the promptExperiment handler of AiragPromptsController that allows any authenticated user to…Check if you run itEPSS 0.19%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates by calling…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates.Check if you run itEPSS 0.19%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to modify tenant settings by calling PUT /sys/tenant/updateApplyStatus.Check if you run itEPSS 0.19%Oct 10, 2026
- High8.6JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to approve tenan…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to r…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change oth…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows authenticated users to retrie…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getUserPermissionSet handler of SystemApiController that allows any authenticated user to…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create validation rules through the SysCheckRu…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any authenticated user to import ca…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes vi…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-application messages via the…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations.Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /s…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments.Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any auth…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to rea…Open the advisoryOct 10, 2026