Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Low2.3Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers to log victims into attacker-controlled accounts because the OpenI…Open the advisoryOct 11, 2026
- Medium5.3Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read link…Check if you run itEPSS 0.25%Oct 11, 2026
- Medium5.3Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocat…Open the advisoryOct 11, 2026
- High8.2Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment endpoints that allows unauthenticated attackers to download private a…Check if you run itEPSS 0.29%Oct 11, 2026
- High7.1Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with Pod read access to obtain secrets by reading init container environ…Open the advisoryOct 11, 2026
- Medium6.9Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unmoderated and rejected product reviews because the…Check if you run itEPSS 0.32%Oct 11, 2026
- Low2.0answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without reso…Open the advisoryOct 11, 2026
- Medium5.3LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API key holders to reach internal hosts via the video-generation callb…Check if you run itEPSS 0.28%Oct 11, 2026
- High8.6Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered clients w…Open the advisoryOct 11, 2026
- High8.7MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application.mcpWebSo…Check if you run itEPSS 0.36%Oct 11, 2026
- Medium5.3SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify EmailMarketing recor…Open the advisoryOct 11, 2026
- Low2.1Authorization Bypass Through User-Controlled KeyCheck if you run itEPSS 0.20%Oct 11, 2026
- High7.5Decompression bomb in : a tiny input can exhaust memory (OOM)Open the advisoryOct 11, 2026
- Medium5.5A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6.Check if you run itEPSS 0.32%Oct 11, 2026
- Medium5.3Furion .NET Framework StringRenderExtensions.cs String.Replace sql injectionCheck if you run itEPSS 0.30%Oct 11, 2026
- UnknownMalicious code in staking-apr-fetcher (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in seed-phrase-validator (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in evm-tx-decoder (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in tron-trc20-utils (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in hd-wallet-generator (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in wallet-balance-scanner (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in ton-jetton-tools (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in wallet-hd-derive (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in perp-funding-rates (RubyGems)Open the advisoryOct 11, 2026
- UnknownMalicious code in block-explorer-api (RubyGems)Open the advisoryOct 11, 2026