Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.7Symfony is a PHP framework for web and console applications and a set of reusable PHP components.Oct 15, 2026
- Medium5.4In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without prope…Oct 15, 2026
- Medium5.4In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and…Oct 15, 2026
- Medium5.4In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with ver…Oct 15, 2026
- Medium5.4In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without pro…Oct 15, 2026
- UnknownAUTOM8N (WHM/cPanel plugin) through commit 82821f7 contains an OS Command Injection in borg_restore.cgi.Oct 15, 2026
- High8.5P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Ser…Oct 15, 2026
- High7.3P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration t…Oct 15, 2026
- UnknownIn the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (2026-09-24), the post-downl…Oct 15, 2026
- Medium4.8A flaw was found in OpenSSH.Oct 15, 2026
- Medium4.6Incomplete dangerous-extension list in PeaZip object open allows execution of a program or command from a crafted archive entry without confirmationOct 15, 2026
- Medium5.4Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQueryOct 15, 2026
- Medium5.4Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQueryOct 15, 2026
- Medium5.4Cross-Site Scripting via Badge Text Binding in Kendo UI for jQueryOct 15, 2026
- Medium5.4Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQueryOct 15, 2026
- Medium4.7Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQueryOct 15, 2026
- Medium4.7Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQueryOct 15, 2026
- Medium4.7Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQueryOct 15, 2026
- Medium4.7Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQueryOct 15, 2026
- Medium6.5Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowserOct 15, 2026
- High7.5Authorization Bypass Through User-Controlled Key vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Contro…Oct 15, 2026
- Medium6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.…Oct 15, 2026
- High8.4Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a…Oct 15, 2026
- Medium6.5Improper Control of Generation of Code ('Code Injection') vulnerability in WPMU DEV Broken Link Checker broken-link-checker allows Code Injection.This issue affects Br…Oct 15, 2026
- Medium4.3A flaw was found in OpenSSH.Oct 15, 2026