Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sy…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries.Check if you run itEPSS 0.27%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizat…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete or…Check if you run itEPSS 0.27%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete A…Check if you run itEPSS 0.27%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to d…Check if you run itEPSS 0.27%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated u…Check if you run itEPSS 0.27%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates.Check if you run itEPSS 0.27%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates.Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records b…Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records.Check if you run itEPSS 0.27%Oct 10, 2026
- Medium5.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates.Check if you run itEPSS 0.24%Oct 10, 2026
- Medium5.3Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach in…Check if you run itEPSS 0.21%Oct 10, 2026
- Medium6.9Unbounded allocation in decimal Decimal.round/3 driven by the places argument enables DoSCheck if you run itEPSS 0.14%Oct 10, 2026
- Medium5.7phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-on…Check if you run itEPSS 0.17%Oct 10, 2026
- Medium6.0OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header.Check if you run itEPSS 0.30%Oct 10, 2026
- Low2.3Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity…Check if you run itEPSS 0.19%Oct 10, 2026
- Medium5.9InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the…Check if you run itEPSS 0.27%Oct 10, 2026
- Medium5.3argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API en…Check if you run itEPSS 0.29%Oct 10, 2026
- High7.1TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via G…Check if you run itEPSS 0.24%Oct 10, 2026
- Low2.3OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile…Check if you run itEPSS 0.20%Oct 10, 2026
- High7.7OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions.Check if you run itEPSS 0.18%Oct 10, 2026
- High8.7SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take…Check if you run itEPSS 0.30%Oct 10, 2026
Sort