CVE-2026-82423 | Medium | 5.4 | 2026-08-29 | A vulnerability has been found in macrozheng mall up to 1.0.3. The affected element is an unknown function of the file /order/paySuccess of the component Payme… |
CVE-2026-55763 | | | 2026-08-28 | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.19, processPercentageRoyaltiesTransfer in core/kapp/accounts/accounts.go cal… |
CVE-2026-78618 | | | 2026-08-28 | A business logic flaw in WatchGuard Dimension allows an authenticated administrator to trigger multiple backend operations within a single logical flow by send… |
CVE-2026-78103 | | | 2026-08-28 | WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/un… |
CVE-2026-77508 | Low | 3.5 | 2026-08-26 | Weblate is a web based localization tool. Prior to 2026.8, an authenticated user can change the account's primary email through PUT or PATCH requests to /api/u… |
CVE-2026-15365 | | | 2026-08-26 | A pop-up logic flaw in a certain feature of Kids Mode allows users to bypass password verification and use Quick Apps outside the app. |
CVE-2026-80195 | Medium | 5.4 | 2026-08-26 | Kimai before 2.63.0 contains a business logic / improper authorization vulnerability in the team update API endpoint (PATCH /api/teams/{id}), which removes all… |
CVE-2026-79083 | High | 7.5 | 2026-08-25 | Improper enforcement of behavioral workflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-75081 | Medium | 4.3 | 2026-08-18 | A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the ar… |
CVE-2026-19993 | Medium | 4.3 | 2026-08-17 | A vulnerability has been found in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the file /customer/account/rma/upda… |
CVE-2026-19213 | Medium | 4.3 | 2026-08-07 | A vulnerability was identified in WonderTrader up to 0.9.9. Affected is the function _undone_qty in the library src/WtCore/TraderAdapter.h of the component Pen… |
CVE-2026-19208 | Low | 3.7 | 2026-08-07 | A vulnerability was detected in WonderTrader up to 0.9.9. Impacted is the function TraderDD::queryTrades of the file src/TraderDD/TraderDD.cpp. The manipulatio… |
CVE-2026-19037 | Medium | 4.3 | 2026-08-06 | A weakness has been identified in WonderTrader up to 0.9.9. This vulnerability affects the function MatchEngine::update_lob of the file src/WtBtCore/MatchEngin… |
CVE-2026-18029 | | | 2026-07-28 | Our payment integration with GiroCheckout did not properly validate
payment status responses. An attacker could use a successful payment
status response from… |
CVE-2026-16103 | Medium | 4.3 | 2026-07-17 | A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force protection checks were ad… |
CVE-2025-36333 | Medium | 4.3 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to perform unauthorized actions due to the improper enforcement of b… |
CVE-2026-57536 | | | 2026-06-25 | Our payment integration with Mollie did not properly validate payment
status responses. An attacker could use a successful payment status
response from one p… |
CVE-2026-13223 | | | 2026-06-25 | Our payment integration with Computop-based payment methods did not
properly validate payment status responses. An attacker could use a
successful payment st… |
CVE-2026-13222 | | | 2026-06-25 | Our payment integration with Oppwa-based payment methods did not
properly validate payment status responses. An attacker could use a
successful payment statu… |
CVE-2026-48505 | High | 7.4 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.11.5 and 5.6.5, a flaw in the handling of recovery co… |
CVE-2026-46540 | Medium | 6.5 | 2026-06-10 | Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.4.0, when LightBlockchain::r… |
CVE-2026-43974 | High | 7.5 | 2026-06-08 | Unexpected Status Code or Return Value vulnerability in ninenines gun (gun_http module) allows a malicious HTTP server to force the client into raw protocol mo… |
CVE-2026-45023 | Medium | 5.4 | 2026-05-28 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.59, POST /api/blocks/{b… |
CVE-2026-8477 | Low | 2.7 | 2026-05-22 | Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access… |
CVE-2026-42303 | | | 2026-05-12 | Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplic… |
CVE-2026-43937 | High | 8.8 | 2026-05-12 | YetAnotherForum.NET (YAF.NET) is a C# ASP.NET forum. Prior to 4.0.5, Any admin OnPost… handler executes its side effects before the ResultFilterAttribute rewri… |
CVE-2026-42246 | High | 7.4 | 2026-05-09 | Net::IMAP implements Internet Message Access Protocol (IMAP) client functionality in Ruby. Prior to versions 0.3.10, 0.4.24, 0.5.14, and 0.6.4, a man-in-the-mi… |
CVE-2026-41259 | High | 7.5 | 2026-04-23 | Mastodon is a free, open-source social network server based on ActivityPub. Prior to v4.5.9, v4.4.16, and v4.3.22, Mastodon allows restricting new user sign-up… |
CVE-2026-34582 | Critical | 9.1 | 2026-04-07 | Botan is a C++ cryptography library. Prior to version 3.11.1, the TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished… |
CVE-2026-30574 | High | 7.5 | 2026-03-27 | A Business Logic vulnerability exists in SourceCodester Pharmacy Product Management System 1.0 in the add-sales.php file. The application fails to verify if th… |
CVE-2025-13459 | Low | 2.7 | 2026-03-16 | IBM Aspera Console 3.3.0 through 3.4.8 could allow a privileged user to cause a denial of service due to improper enforcement of behavioral workflow. |
CVE-2026-30783 | Critical | 9.8 | 2026-03-05 | A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config m… |
CVE-2026-3130 | Critical | 9.8 | 2026-03-03 | Improper Enforcement of Behavioral Controls in Devolutions Server 2025.3.15 and earlier allows an authenticated attacker with the delete permission to delete a… |
CVE-2025-52469 | High | 7.1 | 2026-03-02 | Chamilo is a learning management system. Prior to version 1.11.30, a logic vulnerability in the friend request workflow of Chamilo’s social network module allo… |
CVE-2026-24774 | Medium | 4.3 | 2026-02-03 | The Open eClass platform (formerly known as GUnet eClass) is a complete course management system. Prior to version 4.2, a business logic vulnerability allows a… |
CVE-2025-13751 | Medium | 5.5 | 2025-12-03 | Interactive service agent in OpenVPN version 2.5.0 through 2.6.16 and 2.7_alpha1 through 2.7_rc2 on Windows allows a local authenticated user to connect to the… |
CVE-2025-13129 | Medium | 4.3 | 2025-12-01 | Improper Enforcement of Behavioral Workflow vulnerability in Seneka Software Hardware Information Technology Trade Contracting and Industry Ltd. Co. Onaylarım… |
CVE-2025-13239 | Medium | 4.3 | 2025-11-16 | A security vulnerability has been detected in Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution 5. Affected by this issue is some unknown f… |
CVE-2025-58051 | Medium | 6.5 | 2025-10-16 | Nextcloud Tables allows you to create your own tables with individual columns. Prior 0.7.6, 0.8.8, and 0.9.5, when importing a table, a user was able to specif… |
CVE-2025-55682 | Medium | 6.1 | 2025-10-14 | Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-55337 | Medium | 6.1 | 2025-10-14 | Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-55332 | Medium | 6.1 | 2025-10-14 | Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-55330 | Medium | 6.1 | 2025-10-14 | Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2024-13065 | Medium | 6.3 | 2025-09-03 | Improper Enforcement of Behavioral Workflow, Uncontrolled Resource Consumption vulnerability in Akinsoft MyRezzta allows Input Data Manipulation, CAPEC - 125 -… |
CVE-2025-48482 | Medium | 4.3 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, there is a mass assignment vulnerability. The Customer object is update… |
CVE-2025-48481 | Critical | 9.8 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an attacker with an unactivated email invitation containing invite_hash… |
CVE-2025-48480 | Low | 2.7 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, an authorized user with the administrator role or with the privilege Us… |
CVE-2025-48479 | Low | 2.7 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the laravel-translation-manager package does not correctly validate use… |
CVE-2025-48478 | Medium | 4.9 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, insufficient input validation during user creation has resulted in a ma… |
CVE-2025-48477 | High | 8.1 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, the application's logic requires the user to perform a correct sequence… |
CVE-2025-48476 | High | 8.8 | 2025-05-30 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.180, when adding and editing user records using the fill() method, there is… |
CVE-2025-48376 | Low | 3.5 | 2025-05-23 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to version 9.13.9, a malicious SuperUser (H… |
CVE-2024-12543 | | | 2025-04-21 | User Enumeration and Data Integrity in Barcode functionality in OpenText Content Management versions 24.3-25.1on Windows and Linux allows a malicous authentica… |
CVE-2025-2323 | Medium | 4.3 | 2025-03-15 | A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been declared as problematic. This vulnerability affects the function updateQu… |
CVE-2024-51738 | High | 8.1 | 2025-01-20 | Sunshine is a self-hosted game stream host for Moonlight. In 0.23.1 and earlier, Sunshine's pairing protocol implementation does not validate request order and… |
CVE-2024-46307 | High | 7.5 | 2024-10-09 | A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of products. |
CVE-2024-44128 | Medium | 5.5 | 2024-09-17 | This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7, macOS Ventura 13.7. An Au… |
CVE-2024-39325 | Medium | 5.3 | 2024-07-02 | aimeos/ai-controller-frontend is the Aimeos frontend controller. Prior to versions 2024.04.2, 2023.10.9, 2022.10.8, 2021.10.8, and 2020.10.15, aimeos/ai-contr… |
CVE-2024-6128 | Medium | 5.3 | 2024-06-18 | A vulnerability, which was classified as problematic, has been found in spa-cartcms 1.9.0.6. This issue affects some unknown processing of the file /checkout o… |
CVE-2024-37296 | Medium | 5.3 | 2024-06-11 | The Aimeos HTML client provides Aimeos HTML components for e-commerce projects. Starting in version 2020.04.1 and prior to versions 2020.10.27, 2021.10.21, 202… |
CVE-2024-0410 | High | 7.7 | 2024-02-22 | An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A devel… |
CVE-2023-42939 | Low | 3.3 | 2024-02-21 | A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1. A user's private browsing activity may be unexpectedly saved… |
CVE-2022-46710 | Medium | 5.5 | 2024-01-10 | A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Location data may be shared via iCloud l… |
CVE-2023-5921 | High | 7.1 | 2023-11-22 | Improper Enforcement of Behavioral Workflow vulnerability in DECE Software Geodi allows Functionality Bypass.
This issue affects Geodi: before 8.0.0.27396. |
CVE-2023-4181 | Medium | 5.4 | 2023-08-06 | A vulnerability, which was classified as critical, has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this i… |
CVE-2023-1383 | Medium | 5.4 | 2023-05-03 | An Improper Enforcement of Behavioral Workflow vulnerability in the exchangeDeviceServices function on the amzn.dmgr service allowed an attacker to register se… |
CVE-2022-2105 | Critical | 9.4 | 2022-06-24 | Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for… |
CVE-2022-2102 | Critical | 9.4 | 2022-06-24 | Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modif… |
CVE-2022-1667 | High | 7.5 | 2022-06-24 | Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by loading the correspo… |