Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low2.3crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by supplying their order numbers.Check if you run itEPSS 0.26%Oct 15, 2026
- Medium5.3Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by sup…Check if you run itEPSS 0.25%Oct 15, 2026
- High8.7ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin R…Check if you run itEPSS 0.36%Oct 15, 2026
- Low2.3metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass rol…Check if you run itEPSS 0.23%Oct 15, 2026
- Low2.3Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer…Check if you run itEPSS 0.25%Oct 15, 2026
- Medium6.9Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records vi…Check if you run itEPSS 0.29%Oct 15, 2026
- Medium5.3Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other cu…Check if you run itEPSS 0.22%Oct 15, 2026
- High8.2go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords.Check if you run itEPSS 0.38%Oct 15, 2026
- Medium5.3ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and overwrite other users' commen…Check if you run itEPSS 0.24%Oct 15, 2026
- Medium5.3Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id.Check if you run itEPSS 0.27%Oct 15, 2026
- Medium5.3APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a…Check if you run itEPSS 0.27%Oct 15, 2026
- Medium5.3pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /ad…Check if you run itEPSS 0.25%Oct 15, 2026
- Medium6.3OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added.Check if you run itEPSS 0.28%Oct 15, 2026
- Medium5.3Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to man…Check if you run itEPSS 0.26%Oct 15, 2026
- High8.2JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in servic…Check if you run itEPSS 0.22%Oct 15, 2026
- Critical9.3JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090.Check if you run itEPSS 0.53%Oct 15, 2026
- Medium6.9rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a ta…Check if you run itEPSS 0.32%Oct 15, 2026
- Medium6.9RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks o…Check if you run itEPSS 0.32%Oct 15, 2026
- Critical9.3Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0…Check if you run itEPSS 0.69%Oct 15, 2026
- Medium5.3TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by su…Check if you run itEPSS 0.22%Oct 15, 2026
- Medium6.9ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an un…Check if you run itEPSS 0.32%Oct 15, 2026
- High7.1JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticat…Check if you run itEPSS 0.30%Oct 15, 2026
- Critical9.2OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query recor…Check if you run itEPSS 0.45%Oct 15, 2026
- Medium5.1Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holi…Check if you run itEPSS 0.21%Oct 15, 2026
- High8.8Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check.Check if you run itEPSS 0.47%Oct 15, 2026