Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.8AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokens because the OAuth2 serv…Check if you run itEPSS 0.32%Oct 11, 2026
- Low2.3iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paus…Check if you run itEPSS 0.17%Oct 11, 2026
- Critical9.3BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens using the hard-coded Jwt:Key…Check if you run itEPSS 0.48%Oct 11, 2026
- High8.7mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sen…Check if you run itEPSS 0.55%Oct 11, 2026
- Medium5.3UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary app…Check if you run itEPSS 0.22%Oct 11, 2026
- Medium5.3Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by suppl…Check if you run itEPSS 0.23%Oct 11, 2026
- Medium6.9Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests by injecti…Check if you run itEPSS 0.24%Oct 11, 2026
- Low2.3thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1 API POST /v1/inputs endpoint that allows writes outside the worksp…Check if you run itEPSS 0.25%Oct 11, 2026
- High7.2LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently d…Check if you run itEPSS 0.24%Oct 11, 2026
- High7.6mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that allows sandboxed shell code to read and overwrite files outside the…Check if you run itEPSS 0.32%Oct 11, 2026
- Medium6.9Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust memory via the SNS ingestion endpoint.Check if you run itEPSS 0.32%Oct 11, 2026
- Medium4.8GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before…Check if you run itEPSS 0.11%Oct 11, 2026
- Medium5.3OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticated users to exhaust PHP memory by uploading crafted office documents.Check if you run itEPSS 0.27%Oct 11, 2026
- UnknownCVE-2026-108749Open the advisoryOct 11, 2026
- Low2.3CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export fil…Check if you run itEPSS 0.21%Oct 11, 2026
- High7.3pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening projects.Check if you run itEPSS 0.55%Oct 11, 2026
- High8.7OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all workspaces via…Check if you run itEPSS 0.32%Oct 11, 2026
- Low2.3Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenI…Check if you run itEPSS 0.11%Oct 11, 2026
- Medium5.3Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read link…Check if you run itEPSS 0.25%Oct 11, 2026
- Medium5.3Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocat…Check if you run itEPSS 0.26%Oct 11, 2026
- High8.2Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private a…Check if you run itEPSS 0.29%Oct 11, 2026
- High7.1Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environ…Check if you run itEPSS 0.23%Oct 11, 2026
- Medium6.9Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the…Check if you run itEPSS 0.32%Oct 11, 2026
- Low2.0answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without reso…Check if you run itEPSS 0.14%Oct 11, 2026
- Medium5.3LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callb…Check if you run itEPSS 0.28%Oct 11, 2026
Sort