Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.3Lychee is a free, open-source photo-management tool.Oct 15, 2026
- Low2.1A vulnerability has been found in code-projects Online Reviewer System 1.0.Oct 13, 2026
- High7.1Payload is a free and open source headless content management system.EPSS 0.2%Oct 6, 2026
- Critical9.2Payload is a free and open source headless content management system.EPSS 0.4%Oct 6, 2026
- Medium6.9Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4EPSS 0.3%Oct 5, 2026
- Medium5.3Concrete CMS below 9.5.0 and below is vulnerable to password change without reauthorization and session-hardening bypass.May 21, 2026
- High8.7LiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint.May 21, 2026
- Medium6.9The create and edit flows do not restrict which user properties may be submitted and do not enforce access control on the frontend user group assignment.May 19, 2026
- Medium5.4Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline.May 15, 2026
- High8.7Quark Drive before 0.8.5 contains a mass assignment vulnerability in the POST /update endpoint that allows authenticated attackers to overwrite administrator credentia…May 13, 2026
- Medium5.7CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its model loading component.May 11, 2026
- High7.3CosyVoice thru commit 6e01309e01bc93bbeb83bdd996b1182a81aaf11e (2025-30-21) contains an insecure deserialization vulnerability (CWE-502) in its gRPC server component.May 11, 2026
- Critical9.9Netgate pfSense CE 2.8.0 allows code execution in the XMLRPC API via pfsense.exec_php.May 8, 2026
- Critical9.1Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the post_reboot_commands property.May 8, 2026
- Critical9.1Axios is a promise based HTTP client for the browser and Node.js.May 8, 2026
- High8.3Improperly controlled modification of Dynamically-Determined object attributes, Allocation of resources without limits or throttling vulnerability in DivvyDrive Inform…May 7, 2026
- High8.8Math.js is an extensive math library for JavaScript and Node.js.May 7, 2026
- Critical10.0Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component.Apr 27, 2026
- Critical9.1Axios is a promise based HTTP client for the browser and Node.js.Apr 24, 2026
- Medium6.5Axios is a promise based HTTP client for the browser and Node.js.Apr 24, 2026
- High7.4Axios is a promise based HTTP client for the browser and Node.js.Apr 24, 2026
- High8.7Improperly controlled modification of dynamically-determined object attributes in the Cognito User Pool configuration in AWS Ops Wheel before PR #165 allows remote aut…Apr 24, 2026
- High8.8Math.js is an extensive math library for JavaScript and Node.js.Apr 24, 2026
- Medium6.5Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web.Apr 24, 2026
- High7.6Flowise is a drag & drop user interface to build a customized large language model flow.Apr 23, 2026
53 records · page 1 of 3
PreviousNext