Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.1Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unescaped holi…EPSS 0.2%Oct 15, 2026
- Medium5.1Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Locati…EPSS 0.2%Oct 15, 2026
- High8.8WeGIA is a web manager for charitable institutions.EPSS 0.4%Oct 14, 2026
- Medium6.8BentoPDF is a privacy-focused PDF toolkit that runs in the browser.EPSS 0.2%Oct 14, 2026
- Medium6.3Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-fac…EPSS 0.4%Oct 13, 2026
- UnknownCVE-2026-18061 - XML External Entity (XXE) in AWS Advanced JDBC Wrapper RemoteQueryCachePluginEPSS 0.3%Sep 11, 2026
- Low2.1A vulnerability was determined in haojing8312 WorkClaw up to 0.6.4.May 26, 2026
- High8.3Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox esc…May 14, 2026
- Medium6.3OpenClaw before 2026.4.15 contains an arbitrary local file read vulnerability in the webchat audio embedding helper that fails to apply local media root containment checks.May 11, 2026
- Critical9.8math-codegen generates code from mathematical expressions.May 8, 2026
- High8.3Use after free in Aura in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox esca…May 6, 2026
- High8.3Use after free in Aura in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a s…May 6, 2026
- Medium5.5A security flaw has been discovered in Axle-Bucamp MCP-Docusaurus up to 404bc028e15ec304c9a045528560f4b5f27a17e0.May 5, 2026
- Medium5.3The Five Star Restaurant Reservations plugin for WordPress is vulnerable to a payment bypass via PHP type juggling in versions up to, and including, 2.7.16 This is due…Apr 30, 2026
- Medium6.6python-dotenv reads key-value pairs from a .env file and can set them as environment variables.Apr 20, 2026
- Low2.1A security flaw has been discovered in farion1231 cc-switch up to 3.12.3.Apr 13, 2026
- Medium6.5TREK is a collaborative travel planner.Apr 10, 2026
- Medium5.3TREK is a collaborative travel planner.Apr 10, 2026
- High7.1OpenClaw before 2026.3.24 contains a path traversal vulnerability in sandbox enforcement allowing sandboxed agents to read arbitrary files from other agents' workspace…Apr 10, 2026
- Medium5.3Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe…Apr 8, 2026
- High7.1OpenClaw before 2026.3.24 contains a sandbox bypass vulnerability in the message tool that allows attackers to read arbitrary local files by using mediaUrl and fileUrl…Mar 31, 2026
- Medium5.4The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability checks, allowing any logged-in user, like subscr…EPSS 0.3%Mar 28, 2026
- High8.2The Twilio integration webhook handler accepts any POST request without validating Twilio's 'X-Twilio-Signature'.Mar 27, 2026
- High8.8Wecodex Restaurant CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through t…EPSS 0.5%Mar 26, 2026
- High8.1Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Emaurri emaurri allows PHP Local…Mar 25, 2026
37 records · page 1 of 2
PreviousNext