Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High8.7ThinkCMF through 8.0.1 contains an incorrect authorization vulnerability in RestAdminBaseController that allows restricted backend administrators to call every admin R…Check if you run itEPSS 0.36%Oct 15, 2026
- High8.2go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords.Check if you run itEPSS 0.38%Oct 15, 2026
- Medium5.3pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /ad…Check if you run itEPSS 0.25%Oct 15, 2026
- Medium5.3Dokploy through 0.30.8 contains a cross-organization authorization bypass in the port tRPC router that allows authenticated owners or admins of any organization to man…Check if you run itEPSS 0.26%Oct 15, 2026
- High8.2JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in servic…Check if you run itEPSS 0.22%Oct 15, 2026
- Critical9.3JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090.Check if you run itEPSS 0.53%Oct 15, 2026
- Medium5.3TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by su…Check if you run itEPSS 0.22%Oct 15, 2026
- Medium5.1Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holi…Check if you run itEPSS 0.21%Oct 15, 2026
- Medium6.1ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete RoutesCheck if you run itEPSS 0.23%Oct 15, 2026
- High8.6cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user EndpointsCheck if you run itEPSS 0.42%Oct 15, 2026
- High7.0cool-admin-midway through 8.0.0 Missing Authorization via System Role EndpointsCheck if you run itEPSS 0.26%Oct 15, 2026
- Critical9.5BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator withCheck if you run itEPSS 0.43%Oct 15, 2026
- Critical9.6EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs.Check if you run itEPSS 0.29%Oct 15, 2026
- Critical9.8The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication.Check if you run itEPSS 0.65%Oct 15, 2026
- Medium5.4Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' ParameterCheck if you run itEPSS 0.22%Oct 15, 2026
- Medium6.4Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name ParameterCheck if you run itEPSS 0.20%Oct 15, 2026
- Medium6.4Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network SettingCheck if you run itEPSS 0.20%Oct 15, 2026
- Critical9.1Tianji is an open source analytics, uptime monitoring, and server status platform.Check if you run itEPSS 0.58%Oct 15, 2026
- High8.6An authorization flaw in Idira Conjur version 13.9.0 allows an authenticated user with limited privileges to perform unauthorized actions on a policy branch.Check if you run itEPSS 0.21%Oct 15, 2026
- Medium4.8Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward p…Check if you run itEPSS 0.40%Oct 15, 2026
- High8.6pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute co…Check if you run itEPSS 6.55%Oct 15, 2026
- Medium5.1LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malformed Co…Check if you run itEPSS 0.23%Oct 15, 2026
- Medium5.1Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Locati…Check if you run itEPSS 0.23%Oct 15, 2026
- Medium6.1ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue.Check if you run itEPSS 0.19%Oct 15, 2026
- High8.1Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing CredentialsCheck if you run itEPSS 0.50%Oct 15, 2026