Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any department by ignoring role data scope.Check if you run itEPSS 0.27%Oct 16, 2026
- High7.2Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revoke other tenants' device ce…Check if you run itEPSS 0.18%Oct 16, 2026
- Medium5.3Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockou…Check if you run itEPSS 0.22%Oct 16, 2026
- Medium4.8Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded.Check if you run itEPSS 0.17%Oct 16, 2026
- Medium6.8Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count.Check if you run itEPSS 0.19%Oct 16, 2026
- Medium5.3Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint.Check if you run itEPSS 0.25%Oct 16, 2026
- High7.1ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerIn…Check if you run itEPSS 0.34%Oct 16, 2026
- Medium4.8Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/upd…Check if you run itEPSS 0.12%Oct 16, 2026
- Medium6.9Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/ord…Check if you run itEPSS 0.32%Oct 16, 2026
- Medium5.3FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups bec…Check if you run itEPSS 0.25%Oct 16, 2026
- High7.1Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authenticated users to access priv…Check if you run itEPSS 0.30%Oct 16, 2026
- Medium6.9Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, diagnostics, data-check, scan-…Check if you run itEPSS 0.37%Oct 16, 2026
- High8.6bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers to log in as other users by…Check if you run itEPSS 0.38%Oct 16, 2026
- High8.6Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped report parameter values sent to…Check if you run itEPSS 0.26%Oct 16, 2026
- Medium5.3IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and…Check if you run itEPSS 0.25%Oct 16, 2026
- Medium6.3Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and Bac…Check if you run itEPSS 0.31%Oct 16, 2026
- High7.1FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter.Check if you run itEPSS 0.34%Oct 16, 2026
- High7.1DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other user…Check if you run itEPSS 0.30%Oct 16, 2026
- Medium5.1PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journa…Check if you run itEPSS 0.25%Oct 16, 2026
- Medium5.1eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope be…Check if you run itEPSS 0.33%Oct 16, 2026
- Critical9.3Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port m…Check if you run itEPSS 0.12%Oct 16, 2026
- Critical9.3Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds…Check if you run itEPSS 0.14%Oct 16, 2026
- High7.0Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability.Check if you run itEPSS 0.11%Oct 16, 2026
- High8.2Mailu is a mail server distributed as a set of Docker images.Check if you run itEPSS 0.30%Oct 16, 2026
- Critical9.9MariaDB server is a community developed fork of MySQL server.Check if you run itEPSS 0.55%Oct 16, 2026