Catalog
Vulnerability catalog
Search by CVE, product, or vendor. Filter by severity, CISA KEV, source, stack, and weakness. Filtered views stay out of the search index.
- Critical9.2Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invok…Check if you run itEPSS 0.65%Oct 14, 2026
- Critical9.3Komodo through 2.3.3 contains an authentication bypass vulnerability in the Periphery agent that allows unauthenticated attackers to connect as a trusted Core because…Check if you run itEPSS 0.72%Oct 14, 2026
- High7.0VentureDrake Laravel CRM before 2.4.0 contains an incorrect authorization vulnerability in user management that allows authenticated administrators to assign unrestric…Check if you run itEPSS 0.64%Oct 14, 2026
- High7.1VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire…Check if you run itEPSS 0.57%Oct 14, 2026
- Critical9.2Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255.Check if you run itEPSS 0.43%Oct 14, 2026
- Low2.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val param…Check if you run itEPSS 0.36%Oct 14, 2026
- Medium5.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter.Check if you run itEPSS 0.35%Oct 14, 2026
- Medium5.1ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter.Check if you run itEPSS 0.39%Oct 14, 2026
- Low2.3Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying…Check if you run itEPSS 0.33%Oct 14, 2026
- High7.7Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by…Check if you run itEPSS 0.50%Oct 14, 2026
- High7.7Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management a…Check if you run itEPSS 0.50%Oct 14, 2026
- High8.7Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects…Check if you run itEPSS 0.52%Oct 14, 2026
- Medium6.1Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ow…Check if you run itEPSS 0.56%Oct 14, 2026
- Medium6.3frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers…Check if you run itEPSS 0.78%Oct 14, 2026
- High8.6SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs.Check if you run itEPSS 0.39%Oct 14, 2026
- Medium6.3we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to downlo…Check if you run itEPSS 0.64%Oct 14, 2026
- Critical9.2NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_to…Check if you run itEPSS 0.81%Oct 14, 2026
- High7.1jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change oth…Check if you run itEPSS 0.44%Oct 14, 2026
- High7.1Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sor…Check if you run itEPSS 0.47%Oct 14, 2026
- High7.1youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint.Check if you run itEPSS 0.41%Oct 14, 2026
- Critical9.3vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil.Check if you run itEPSS 1.00%Oct 14, 2026
- Medium6.0REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership.Check if you run itEPSS 0.34%Oct 14, 2026
- Medium5.3ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the ser…Check if you run itEPSS 0.30%Oct 14, 2026
- High7.1Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword paramet…Check if you run itEPSS 0.47%Oct 14, 2026
- Medium5.3BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows au…Check if you run itEPSS 0.40%Oct 14, 2026