Search Vulnerabilities

In JetBrains IntelliJ IDEA before 2026

Ninja Forms Server-Side Validation Bypass via Client-Controlled Field Metadata Merge in AJAX Submission Handler

Business Logic Bypass in Gobito's Corporate Training Management System

Dash: Users can write to config despire permissions (OIDC tested)

Vulnerabilities found in Watson Data Intelligence

Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts

Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about students by in...

Capgo - Two-Factor Authentication Bypass via Organization Management API

NanoClaw < 2.1.17 - Privilege Escalation via Unauthorized create_agent System Action

U.S. GAO EPDS and CBCA EDS client-based privilege escalation

Iris has an Open Redirect issue

Open WebUI: Open WebUI Improper Authorization Control

JupyterLab has an Extension Manager API/GUI Policy Discrepancy allowing 3rd party (malicious) extensions install via POST request.

Data Space Portal: Incorrect Authorization and Client-Side Enforcement of Server-Side Security in ghcr.io/sovity/ds-portal-ce-backend

Frappe Learning Management System has Client-Side Manipulation of Quiz Scores

FileBrowser Quantum Incomplete Remediation of CVE-2026-27611: Password-Protected Share Bypass via /public/api/share/info

Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)

Frappe: Broken Access Control in DocShare

RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies

Dell Wyse Management Suite, versions prior to WMS 5