Catalog
Findings
Filter by record type (vulnerability, fix, incident, intelligence, research), severity, source, stack, and weakness.
- UnknownMalicious code in @beloved-lenora/opencode-shell-guard (npm)Oct 16, 2026
- UnknownMalicious code in @beloved-lenora/opencode-shared-rpc (npm)Oct 16, 2026
- UnknownMalicious code in @beloved-lenora/opencode-orchestrator (npm)Oct 16, 2026
- UnknownMalicious code in @beloved-lenora/opencode-goal (npm)Oct 16, 2026
- UnknownMalicious code in @beloved-lenora/opencode-btw (npm)Oct 16, 2026
- Low3.3Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded.EPSS 0.1%Oct 16, 2026
- Medium5.5nfs-utils: nfs-utils: Denial of Service via assertion failure in fsiddEPSS 0.1%Oct 16, 2026
- High7.5axios: Axios affected by Denial of Service via __proto__ Key in mergeConfigEPSS 2.0%Oct 16, 2026
- High7.5golang: net/url: Memory exhaustion in query parameter parsing in net/urlEPSS 2.3%Oct 16, 2026
- Medium5.3A flaw was found in libtirpc.EPSS 0.2%Oct 16, 2026
- Medium6.4xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' ParameterEPSS 0.2%Oct 16, 2026
- High8.1User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart TagOct 16, 2026
- Medium4.3User Registration & Membership <= 5.2.8 - Cross-Site Request Forgery to trigger_bulk_action()Oct 16, 2026
- High7.2User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field ValueOct 16, 2026
- Medium6.8WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce ReuseEPSS 0.3%Oct 16, 2026
- High7.5WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' ActionEPSS 0.3%Oct 16, 2026
- High7.2EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' ParameterEPSS 0.2%Oct 16, 2026
- Medium6.4Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode AttributeEPSS 0.2%Oct 16, 2026
- Critical9.8LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' ParameterEPSS 0.0%Oct 16, 2026
- Medium6.5LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX ActionEPSS 0.3%Oct 16, 2026
- Low3.7Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' ParameterEPSS 0.3%Oct 16, 2026
- High7.5Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' ParameterEPSS 0.4%Oct 16, 2026
- Critical9.1Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts CounterEPSS 0.4%Oct 16, 2026
- Medium6.1Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' ParameterEPSS 0.2%Oct 16, 2026
- High7.2Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template ImportEPSS 0.5%Oct 16, 2026