Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may includ…Check if you run itEPSS 0.37%Oct 11, 2026
- Medium5.3Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs.Check if you run itEPSS 0.28%Oct 11, 2026
- High7.2pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that allows authenticated members t…Check if you run itEPSS 0.38%Oct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated user to rea…Check if you run itEPSS 0.19%Oct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged authenticated users to del…Check if you run itEPSS 0.21%Oct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any authenticated user to delete…Check if you run itEPSS 0.21%Oct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any authenticated user to modify lo…Check if you run itEPSS 0.19%Oct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI ch…Check if you run itEPSS 0.19%Oct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify us…Check if you run itEPSS 0.19%Oct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user…Check if you run itEPSS 0.19%Oct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to…Check if you run itEPSS 0.17%Oct 11, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys…Check if you run itEPSS 0.21%Oct 11, 2026
- Medium5.3A vulnerability was detected in erzhongxmu Jeewms up to 3.7.Check if you run itEPSS 0.26%Oct 11, 2026
- Low2.1A weakness has been identified in zhayujie CowAgent up to 2.1.6.Check if you run itEPSS 0.24%Oct 11, 2026
- High8.8AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 serv…Check if you run itEPSS 0.32%Oct 11, 2026
- Low2.3iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paus…Check if you run itEPSS 0.17%Oct 11, 2026
- Critical9.3BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key…Check if you run itEPSS 0.48%Oct 11, 2026
- High8.7mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sen…Check if you run itEPSS 0.55%Oct 11, 2026
- Medium5.3UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary app…Check if you run itEPSS 0.22%Oct 11, 2026
- Medium5.3Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by suppl…Check if you run itEPSS 0.23%Oct 11, 2026
- Medium6.9Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecti…Check if you run itEPSS 0.24%Oct 11, 2026
- Low2.3thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the worksp…Check if you run itEPSS 0.25%Oct 11, 2026
- High7.2LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently d…Check if you run itEPSS 0.24%Oct 11, 2026
- High7.6mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the…Check if you run itEPSS 0.32%Oct 11, 2026
- Medium6.9Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint.Check if you run itEPSS 0.32%Oct 11, 2026
Sort