Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium6.9BillionMail through 4.9 Forgeable JWTs via Default Signing KeyCheck if you run itEPSS 0.26%Oct 15, 2026
- High8.6cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user EndpointsCheck if you run itEPSS 0.42%Oct 15, 2026
- High7.0cool-admin-midway through 8.0.0 Missing Authorization via System Role EndpointsCheck if you run itEPSS 0.26%Oct 15, 2026
- High7.1MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET BranchCheck if you run itEPSS 0.24%Oct 15, 2026
- Critical9.5BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator withCheck if you run itEPSS 0.43%Oct 15, 2026
- UnknownApache Airflow SFTP provider: Async SFTP hook disables host-key verification by defaultCheck if you run itEPSS 0.22%Oct 15, 2026
- MediumApache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement tokenCheck if you run itEPSS 0.34%Oct 15, 2026
- UnknownApache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by defaultCheck if you run itEPSS 0.30%Oct 15, 2026
- UnknownThe Apache Airflow Keycloak provider's multi-team provisioning ( ) granted every team role global read access to audit logs.Check if you run itEPSS 0.26%Oct 15, 2026
- High8.8The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment).Check if you run itEPSS 0.35%Oct 15, 2026
- Critical9.6EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.Check if you run itEPSS 0.29%Oct 15, 2026
- Critical9.8The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication.Check if you run itEPSS 0.65%Oct 15, 2026
- Critical9.9EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supply…Check if you run itEPSS 0.40%Oct 15, 2026
- High7.5EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over…Check if you run itEPSS 0.24%Oct 15, 2026
- High7.8The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations.Check if you run itEPSS 0.20%Oct 15, 2026
- High8.2The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication.Check if you run itEPSS 0.56%Oct 15, 2026
- High8.8The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled.Check if you run itEPSS 0.35%Oct 15, 2026
- Critical9.1The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not cons…Check if you run itEPSS 0.90%Oct 15, 2026
- High7.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.Check if you run itEPSS 0.65%Oct 15, 2026
- High7.0Ivanti Connect Secure and Policy Secure Inclusion of Functionality from Untrusted Control SpherePatch nowKEVEPSS 0.25%Oct 15, 2026
- Medium5.3ZoneMinder is a free, open source closed-circuit television software application.Check if you run itEPSS 0.39%Oct 15, 2026
- High8.8DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment EndpointCheck if you run itEPSS 0.52%Oct 15, 2026
- High7.2SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in CommentCheck if you run itEPSS 0.28%Oct 15, 2026
- Medium6.4Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode AttributeCheck if you run itEPSS 0.19%Oct 15, 2026
- Medium5.4The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5.Check if you run itEPSS 0.23%Oct 15, 2026