Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low2.1A vulnerability was found in 021is elvix-sdk up to 0.10.1.Check if you run itEPSS 0.20%Oct 11, 2026
- Medium5.31Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side…Open the advisoryOct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController editIzTop handler that allows low-privileged authenticated user…Check if you run itEPSS 0.19%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to restore deleted AI prompt templates by calling…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController edit handler that allows any authenticated user to modify AI prompt templates.Check if you run itEPSS 0.19%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove users from tenant product packs via PUT…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the QuartzJobController queryById handler that allows low-privileged authenticated users to r…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController updateAvatar handler that allows any authenticated user to change oth…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysCategoryController that allows any authenticated user to edit category dictionary nodes vi…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController queryById handler that lacks Shiro permission annotations.Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to rea…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules.Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sy…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizat…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to d…Check if you run itEPSS 0.27%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated u…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates.Check if you run itEPSS 0.27%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates.Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records b…Open the advisoryOct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates.Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach in…Open the advisoryOct 10, 2026
- Medium6.9Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoSCheck if you run itEPSS 0.14%Oct 10, 2026
- Low2.3Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity…Check if you run itEPSS 0.19%Oct 10, 2026
- Medium5.3argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API en…Check if you run itEPSS 0.29%Oct 10, 2026