Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.4Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code.Check if you run itEPSS 0.23%Oct 12, 2026
- Medium5.4Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions.Check if you run itEPSS 0.39%Oct 12, 2026
- Medium5.3LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to th…Open the advisoryOct 12, 2026
- Medium5.3MoguBlog through 6.2 contains a broken access control vulnerability that allows authenticated administrators to move or rename other administrators' network-disk files…Check if you run itEPSS 0.20%Oct 12, 2026
- Medium5.3yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calli…Check if you run itEPSS 0.20%Oct 12, 2026
- High7.1LavaLite CMS through 10.1.2 contains an authorization bypass vulnerability that allows authenticated low-privileged users to modify other users' accounts by abusing th…Check if you run itEPSS 0.30%Oct 12, 2026
- Low2.1A security vulnerability has been detected in meetecho janus-gateway up to 1.4.2.Check if you run itEPSS 0.26%Oct 12, 2026
- Unknownhex_core's default HTTP adapter doesn't verify TLS certificates on OTP 24 and 25Check if you run itEPSS 0.24%Oct 12, 2026
- Low2.0A security flaw has been discovered in Zen Cart up to 2.2.2.Check if you run itEPSS 0.33%Oct 12, 2026
- Low1.2A vulnerability was determined in Zen Cart up to 2.2.2.Check if you run itEPSS 0.33%Oct 12, 2026
- UnknownMalicious code in minecraftaccfinder (PyPI)Open the advisoryOct 12, 2026
- Medium5.5A security vulnerability has been detected in SEMCMS up to 5.0.Check if you run itEPSS 0.31%Oct 12, 2026
- UnknownSecurity update for opensshOpen the advisoryOct 12, 2026
- Critical9.1Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its password is changed.Check if you run itEPSS 0.30%Oct 12, 2026
- High8.7A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory.Check if you run itEPSS 0.72%Oct 12, 2026
- Medium4.8An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the brows…Check if you run itEPSS 0.14%Oct 12, 2026
- Medium5.4An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) attack.Check if you run itEPSS 0.12%Oct 12, 2026
- Medium4.3Cross-Site Request Forgery in Administrative ActionsCheck if you run itEPSS 0.14%Oct 12, 2026
- Medium5.3Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs.Check if you run itEPSS 0.28%Oct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify us…Check if you run itEPSS 0.19%Oct 11, 2026
- Critical9.3BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key…Check if you run itEPSS 0.48%Oct 11, 2026
- High8.6Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients w…Open the advisoryOct 11, 2026
- UnknownMalicious code in staking-apr-fetcher (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in seed-phrase-validator (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in evm-tx-decoder (RubyGems)Open the advisoryOct 11, 2026