Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium5.9Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application.EPSS 0.1%Oct 16, 2026
- Medium6.5Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production, by supplying an X-Wheels-…EPSS 0.2%Oct 16, 2026
- Medium6.5In versions till , The default rate-limit key resolver, , derives the per-client bucket key from the leftmost element of the request header.EPSS 0.2%Oct 15, 2026
- Critical9.5In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific…EPSS 0.2%Oct 15, 2026
- High8.7HestiaCP versions 1.2.0 through 1.9.4 contain an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by s…May 19, 2026
- Critical9.8Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, and supported download clients like qBittorrent.May 12, 2026
- Medium6.4In nspawn in systemd 233 through 259 before 260, an escape-to-host action can occur via a crafted optional config file.Apr 10, 2026
- High8.7Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server.Apr 6, 2026
- Medium6.5Shynet before 0.14.0 allows Host header injection in the password reset flow.Apr 3, 2026
- Medium5.1Szafir SDK Web is a browser plug-in that can run SzafirHost application which download the necessary files when launched.Apr 2, 2026
- Medium5.3WWBN AVideo is an open source video platform.Mar 23, 2026
- Medium6.1Summary When trustProxy is configured with a restrictive trust function (e.g., a specific IP like trustProxy: '10.0.0.1', a subnet, a hop count, or a custom function),…Mar 23, 2026
- High7.5Raytha CMS allows an attacker to spoof or headers to attacker controlled domain.EPSS 0.2%Mar 16, 2026
- Medium6.9wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to bypass IP-based rate limiting and ban enforcement by trus…EPSS 0.2%Mar 13, 2026
14 records · page 1 of 1
PreviousNext