Latest CVE Feed
Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users…
Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is u…
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val parameter in mode=add_todo. Attackers…
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/language_settings.php via the unencoded edit_language GET parameter. Attackers can send administ…
ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/flagged_item.php via the unencoded type GET parameter. Attackers can send crafted flagged_item.p…
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers…
Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs.…
Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_p…
Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own or…
Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ownership against the supplied org…
frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug endpoints because handlers are registered on the root mux …
SmsForwarder through 3.5.0 contains a missing authentication vulnerability in its AndServer HTTP server that allows unauthenticated network attackers to invoke remote-control APIs. Attackers can call…
we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its a…
NullHub through 2026.5.29 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* management API because the auth_token field defaults to null and i…
jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attack…
Yiuman citrus through 0.15.0 contains an ORDER BY sql injection vulnerability in the citrus-support generic query framework that allows users to inject SQL via the sortBy request parameter. Attackers…
youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint. Attackers can page…
vlife through 2.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge JWTs using the hardcoded HS256 signing key in TokenUtil. Attackers can sign a token …
REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership. Authenticated low-privileg…
ruoyi-vue-pro through 2026.09 contains a server-side request forgery vulnerability in the yudao-module-ai image service that allows authenticated users to make the server fetch arbitrary URLs by supp…