Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- UnknownMalicious code in itsa-react-maskedinput (npm)Oct 16, 2026
- UnknownMalicious code in itsa-react-focuscontainer (npm)Oct 16, 2026
- Medium6.5perl-text-csv_xs: Text::CSV_XS: Data corruption via trailing carriage return in empty fieldsOct 16, 2026
- High8.8Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)Oct 16, 2026
- Medium4.3Arcane: Environment access token bypasses the admin-required authorization gate onOct 16, 2026
- Critical9.8LMCache: Remote code execution via unsafe deserialization in multiprocess mode transportOct 16, 2026
- Medium6.5Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destinationOct 16, 2026
- High7.5lopdf has a stack overflow via deeply nested PDF objectsOct 16, 2026
- High7.5JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoSOct 16, 2026
- UnknownPayment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' ParameterOct 16, 2026
- Low3.7CoreDNS headless AXFR can emit an empty transfer batch that panics the pluginOct 16, 2026
- Low3.1ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)Oct 16, 2026
- Lowswoosh has email-derived URL path injection in Microsoft Graph endpointOct 16, 2026
- UnknownMalicious code in @beloved-lenora/opencode-todo (npm)Oct 16, 2026
- UnknownMalicious code in @beloved-lenora/opencode-stats (npm)Oct 16, 2026
- UnknownMalicious code in @beloved-lenora/opencode-shell-guard (npm)Oct 16, 2026
- UnknownMalicious code in @beloved-lenora/opencode-shared-rpc (npm)Oct 16, 2026
- UnknownMalicious code in @beloved-lenora/opencode-orchestrator (npm)Oct 16, 2026
- UnknownMalicious code in @beloved-lenora/opencode-goal (npm)Oct 16, 2026
- UnknownMalicious code in @beloved-lenora/opencode-btw (npm)Oct 16, 2026
- Medium5.5nfs-utils: nfs-utils: Denial of Service via assertion failure in fsiddOct 16, 2026
- High7.5axios: Axios affected by Denial of Service via __proto__ Key in mergeConfigOct 16, 2026
- High7.5golang: net/url: Memory exhaustion in query parameter parsing in net/urlOct 16, 2026
- High7.5sync 2026-10-16T15:41:51ZOct 16, 2026
- UnknownxSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' ParameterOct 16, 2026
13,334 records · page 1 of 534
PreviousNext