Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.7DataEase is an open source data visualization and analysis tool.EPSS 0.3%Oct 14, 2026
- Medium5.4lichess.org is the forever free, adless and open source chess server.EPSS 0.2%Oct 14, 2026
- High8.2Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.EPSS 0.7%Oct 14, 2026
- UnknownGitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting.EPSS 0.3%Oct 14, 2026
- Low3.5Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in…EPSS 0.4%Oct 14, 2026
- Critical9.8Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files.EPSS 28.3%Oct 14, 2026
- Critical9.2Beganovich snappdf from 1.1.0 before 6.1.0 contains an OS command injection vulnerability on Windows that allows attackers to run commands by influencing the rendered URL.EPSS 2.1%Oct 14, 2026
- Medium6.8libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table.EPSS 0.2%Oct 14, 2026
- Medium5.3BottleCRM through 1.14.5 contains a server-side template injection vulnerability in the send_email Celery task, which compiles the user-supplied AccountEmail message_b…EPSS 0.4%Oct 14, 2026
- Medium5.1BottleCRM 0.30 through 1.14.5 contains an HTML injection vulnerability in render_invoice_template() that allows authenticated organization members to inject markup int…EPSS 0.4%Oct 14, 2026
- Medium6.5svg-sanitizer is a PHP SVG/XML sanitizer.EPSS 0.4%Oct 14, 2026
- High8.7Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages.EPSS 0.7%Oct 14, 2026
- UnknownSecurity update for webkit2gtk3Oct 14, 2026
- High8.8Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced AuthenticationFilter verbatim, unescaped and unEPSS 0.5%Oct 14, 2026
- Medium4.9The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name (profile.php) + comment (wp-comments-post.php)' parame…EPSS 0.2%Oct 14, 2026
- High8.1The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the ' _type (e.g.EPSS 1.0%Oct 14, 2026
- Medium4.3The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u…EPSS 0.3%Oct 14, 2026
- Medium6.8The Pricing Table WordPress plugin before 2.1.5 does not validate the scheme of a user-supplied link value in one of its blocks before rendering it, allowing users wit…EPSS 0.3%Oct 14, 2026
- Medium5.3The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or input sanitization before storing certain values from a request, allo…EPSS 0.2%Oct 14, 2026
- Medium5.3The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter.Oct 14, 2026
- High7.5The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs' parameter in all…EPSS 0.4%Oct 14, 2026
- Medium5.4blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability.EPSS 0.2%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploadi…EPSS 0.2%Oct 13, 2026
- Medium5.1Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a f…Oct 13, 2026
- High7.5The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly veri…EPSS 0.5%Oct 13, 2026