Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Medium5.3Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by sup…Check if you run itEPSS 0.25%Oct 15, 2026
- Low2.3Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer…Check if you run itEPSS 0.25%Oct 15, 2026
- Medium6.9Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records vi…Check if you run itEPSS 0.29%Oct 15, 2026
- Medium5.3Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by supplying another conversation's id.Check if you run itEPSS 0.27%Oct 15, 2026
- Medium5.3APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a…Check if you run itEPSS 0.27%Oct 15, 2026
- Medium6.3OxiCloud 0.9.1 through 0.9.3 contains an incorrect authorization vulnerability that allows anonymous visitors to keep share access after password protection is added.Check if you run itEPSS 0.28%Oct 15, 2026
- Medium6.9RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint because validate_url checks o…Check if you run itEPSS 0.32%Oct 15, 2026
- Medium5.3TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by su…Check if you run itEPSS 0.22%Oct 15, 2026
- Medium6.9ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backend requests by setting an un…Check if you run itEPSS 0.32%Oct 15, 2026
- High7.1JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticat…Check if you run itEPSS 0.30%Oct 15, 2026
- High8.8Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers bypass the file path length check.Check if you run itEPSS 0.47%Oct 15, 2026
- Medium6.9NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the expected code is printed as…Check if you run itEPSS 0.32%Oct 15, 2026
- High8.8The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment).Check if you run itEPSS 0.35%Oct 15, 2026
- Medium5.4Scoold is a Q&A and a knowledge sharing platform for teams.Check if you run itEPSS 0.11%Oct 15, 2026
- High8.1AliasVault is a privacy-first password manager with built-in email aliasing.Check if you run itEPSS 0.15%Oct 15, 2026
- High8.8Tianji is an open source analytics, uptime monitoring, and server status platform.Check if you run itEPSS 0.34%Oct 15, 2026
- Critical9.1An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon.Check if you run itEPSS 0.38%Oct 15, 2026
- Low2.3La Suite Docs through 6.0.0 contains an authorization bypass vulnerability that allows authenticated users to write comments into threads of documents they cannot access.Check if you run itEPSS 0.27%Oct 15, 2026
- High8.7LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_t…Check if you run itEPSS 0.42%Oct 15, 2026
- High7.5undici is an HTTP client library for Node.js.Check if you run itEPSS 0.34%Oct 15, 2026
- High7.4undici is an HTTP client library for Node.js.Check if you run itEPSS 0.15%Oct 15, 2026
- High7.4undici is an HTTP client library for Node.js.Check if you run itEPSS 0.18%Oct 15, 2026
- High7.4A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator.Check if you run itEPSS 0.33%Oct 15, 2026
- Medium6.0temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for.Check if you run itEPSS 0.36%Oct 15, 2026
- High8.1Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing CredentialsCheck if you run itEPSS 0.50%Oct 15, 2026