Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- High7.1fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenti…Check if you run itEPSS 0.30%Oct 13, 2026
- Medium5.3Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by…Check if you run itEPSS 0.25%Oct 13, 2026
- High8.6FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify o…Check if you run itEPSS 0.30%Oct 13, 2026
- Medium5.3Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' da…Check if you run itEPSS 0.22%Oct 13, 2026
- High7.1Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and d…Check if you run itEPSS 0.27%Oct 13, 2026
- High8.7Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows…Check if you run itEPSS 0.43%Oct 13, 2026
- Medium6.9FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by callin…Check if you run itEPSS 0.41%Oct 13, 2026
- High8.6MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/a…Check if you run itEPSS 0.30%Oct 13, 2026
- Low2.3RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings…Check if you run itEPSS 0.28%Oct 13, 2026
- Medium5.1bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content…Check if you run itEPSS 0.23%Oct 13, 2026
- High7.7Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verification with curl -k and sk…Check if you run itEPSS 0.12%Oct 13, 2026
- Medium5.3Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by…Check if you run itEPSS 0.24%Oct 13, 2026
- High8.6Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token.Check if you run itEPSS 0.43%Oct 13, 2026
- Medium5.3Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue…Check if you run itEPSS 0.18%Oct 13, 2026
- Medium4.3Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce allows Exploiting Incorrectly…Check if you run itEPSS 0.16%Oct 13, 2026
- Medium5.3Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Secur…Check if you run itEPSS 0.19%Oct 13, 2026
- UnknownA vulnerability was found in libsndfile up to 1.2.2.Check if you run itEPSS 0.39%Oct 13, 2026
- Low2.1A vulnerability has been found in GPAC up to 26.07.0.Check if you run itEPSS 0.29%Oct 13, 2026
- Medium5.5A vulnerability has been found in SourceCodester Online Reviewer System 1.0.Check if you run itEPSS 0.41%Oct 13, 2026
- Critical9.9An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication information.Check if you run itEPSS 0.87%Oct 13, 2026
- High7.7A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files.Check if you run itEPSS 0.73%Oct 13, 2026
- High7.5A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacker to create, modify, trusted site.Check if you run itEPSS 0.66%Oct 13, 2026
- Critical9.9An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to redirect application-generat…Check if you run itEPSS 0.79%Oct 13, 2026
- Medium5.5An Information Exposure Through Log Files vulnerability in Ivanti Xtraction Cloud Sync before version 2026.4 allows a remote authenticated attacker to disclose partial…Check if you run itEPSS 0.31%Oct 13, 2026
- Medium5.0A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system.Check if you run itEPSS 0.47%Oct 13, 2026