Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.2JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in servic…EPSS 0.2%Oct 15, 2026
- Critical9.3JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090.EPSS 0.5%Oct 15, 2026
- Medium6.9rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a ta…EPSS 0.3%Oct 15, 2026
- Medium6.9RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks o…EPSS 0.3%Oct 15, 2026
- Critical9.3Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0…EPSS 0.7%Oct 15, 2026
- Medium5.3TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by su…EPSS 0.2%Oct 15, 2026
- Medium6.9ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an un…EPSS 0.3%Oct 15, 2026
- High7.1JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticat…EPSS 0.3%Oct 15, 2026
- Critical9.2OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query recor…EPSS 0.5%Oct 15, 2026
- Medium5.1Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holi…EPSS 0.2%Oct 15, 2026
- Critical9.5BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local admini…EPSS 0.4%Oct 15, 2026
- High8.8Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check.EPSS 0.5%Oct 15, 2026
- Critical9.3Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root com…EPSS 0.6%Oct 15, 2026
- High8.3snap7 through 1.4.3 contains an out-of-bounds write vulnerability in TSnap7MicroClient::opReadArea() that allows malicious S7 peers to overflow client buffers via an u…EPSS 0.4%Oct 15, 2026
- High8.7Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passing a negative COUNT to HRAN…EPSS 0.5%Oct 15, 2026
- Medium6.9NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as…EPSS 0.3%Oct 15, 2026
- High8.7NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest…EPSS 0.4%Oct 15, 2026
- Medium6.9nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked.EPSS 0.1%Oct 15, 2026
- Medium6.8unarr through 1.1.1 contains a heap-based out-of-bounds read in zip_parse_extra_fields() in zip/parse-zip.c due to an incorrect ZIP64 extra field length check.EPSS 0.1%Oct 15, 2026
- Medium6.9unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_get_name() API.EPSS 0.1%Oct 15, 2026
- Medium6.8LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short ShotInfo buffer.EPSS 0.1%Oct 15, 2026
- Medium6.8libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows attackers to read adjacent…EPSS 0.1%Oct 15, 2026
- Medium6.9libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS.EPSS 0.1%Oct 15, 2026
- Medium6.9libical through 4.0.6 contains a heap-based out-of-bounds read in icalvalue_decode_ical_string() in src/libical/icalvalue.c when decoding input ending in a backslash.EPSS 0.1%Oct 15, 2026
- High8.8Use after free in Prerender in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.EPSS 0.2%Oct 15, 2026