65468+ vulnerabilities with CVSS scores, EPSS exploit predictions, and CISA KEV status. Updated daily.
SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by id through GET /api/public/preview/{attachmentId}. Attackers who know …
MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers …
DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the membership check for dialogs with group_type 'okr'. Authenticated users can supply the …
NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction records via GET /api/fields/{resource}/{identifier}. Attackers can request transaction field …
Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution directory via the path parameter of …
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into disallowed companies by supplying a …
Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJAX actions intended for manage_options users. Attackers can call …
abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that allows authenticated users to access other users' AI chat …
IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants' data because Customers and Devices API …
10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects by double unserializing distributed post meta. Attackers …
10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to publish posts on other network sites. Attackers can …
Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. …
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated …
TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. …
O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify …
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. …
CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers …
WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every …
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with …
Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController …
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by …
roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can …
B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. …
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership …
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. …
SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send …
IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a …
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access …
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated …
PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field …
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within …
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django …
Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an …
Discourse Doc Categories is a plugin for organizing Discourse topics as documentation. Prior to the verified source fix, the doc category index refresh resolves linked …
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. From 1.6.1 until 1.6.2, a successful …
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process deeply nested XML …
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.13.0 until 1.27.2, 1.28.2, and 1.29.0, _import_document_row in src/openzaak/components/documenten/tasks.py uses the …
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek …
An issue was discovered in GStreamer gst-plugins-good before 1.28.2. While parsing an MP4 file, the isomp4 plugin's qtdemux_parse_uuid function may read past the end of …
SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService.ts and SparkyFitnessServer/services/labelScanService.ts do not validate destinations supplied in custom AI …
Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LAN or Tailnet clients to bypass the privileged mediastream settings …
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server …
An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting account, regardless of whether …
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via …
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious …
Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with only View permission to obtain add-on passwords via the …
Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to …
Free website and port scanning — find vulnerabilities before attackers do.