Export limit exceeded: 409416 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15495 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109364 | 2 Zcashfoundation, Zfnd | 2 Zebra, Zebra | 2026-10-13 | 5.3 Medium |
| Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list to restore access for banned peers. | ||||
| CVE-2026-109363 | 2 Zcashfoundation, Zfnd | 2 Zebra, Zebra | 2026-10-13 | 7.5 High |
| ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad. Unauthenticated peers can send a single pre-handshake tx message to crash the node, and can repeat this after each restart. | ||||
| CVE-2026-109349 | 1 Gitoxidelabs | 1 Gix-date | 2026-10-13 | 6.5 Medium |
| gitoxide gix-pack before 0.75.0 contains a reachable assertion in BytesToEntriesIter::new_from_header: the pack header decoder accepts version 3, but a release-enabled assert_eq! requires version 2. A malicious remote can send a 12-byte pack header declaring version 3 to panic the client and abort the clone or fetch. | ||||
| CVE-2026-109343 | 1 Surrealdb | 1 Surrealdb | 2026-10-13 | 8.1 High |
| SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create, update, or delete rows in tables whose PERMISSIONS allow it, such as PERMISSIONS FULL. | ||||
| CVE-2026-109334 | 1 Surrealdb | 1 Surrealdb | 2026-10-13 | 8.1 High |
| SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it. | ||||
| CVE-2026-109329 | 1 Admidio | 1 Admidio | 2026-10-13 | 6.5 Medium |
| Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles. | ||||
| CVE-2026-109289 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-10-13 | 6.3 Medium |
| Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server. | ||||
| CVE-2026-109264 | 1 Imagemagick | 1 Imagemagick | 2026-10-13 | 3.7 Low |
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service. | ||||
| CVE-2026-108862 | 1 Apiparklab | 1 Apipark | 2026-10-13 | 5.3 Medium |
| APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query /api/v1/app/authorization or its details route to retrieve plaintext API keys regardless of HideCredential. | ||||
| CVE-2026-108752 | 2 Jupyter, Jupyterhub | 2 Jupyterhub, Jupyterhub | 2026-10-13 | 4.2 Medium |
| JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server. | ||||
| CVE-2026-108747 | 1 Lightdash | 1 Lightdash | 2026-10-13 | 4.2 Medium |
| Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations. | ||||
| CVE-2026-107810 | 1 0xjacky | 1 Nginx-ui | 2026-10-13 | 8.1 High |
| Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create and restore backups can craft a valid backup that places a symlink in the staging tree and then writes a regular file through that link, even when both restore flags are false. This can persistently inject configuration or cause denial of service when the modified files are later consumed. This issue is fixed in version 2.5.0. | ||||
| CVE-2026-110127 | 2026-10-13 | 4.3 Medium | ||
| waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items. | ||||
| CVE-2026-110122 | 1 Pickmall | 1 Lilishop | 2026-10-13 | 4.3 Medium |
| PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges. | ||||
| CVE-2026-94603 | 1 Podman Project | 1 Podman | 2026-10-13 | 10 Critical |
| Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3. | ||||
| CVE-2026-102981 | 1 Makeplane | 1 Plane | 2026-10-13 | 6.5 Medium |
| Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. This issue is fixed in version 1.4.0. | ||||
| CVE-2026-78022 | 1 Dell | 2 Policy Manager For Secure Connect Gateway, Secure Connect Gateway Policy Manager | 2026-10-13 | 6.8 Medium |
| Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. | ||||
| CVE-2026-84321 | 1 0xjacky | 1 Nginx-ui | 2026-10-13 | 5.4 Medium |
| Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain in the short_token cache and authenticate again if the associated account is re-enabled before the cache entry expires because GetTokenUserByShortToken reads the surviving entry, restoring access to HTTP or WebSocket routes that accept short-token authentication. This issue is fixed in version 2.4.1. | ||||
| CVE-2026-77366 | 1 The-40-thieves | 1 Obsidian-tc | 2026-10-13 | 9.9 Critical |
| obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools. Version 1.3.1 fixes the vulnerability by binding tokens and request context to a vault and rejecting mismatched input.vault values before scope checks. | ||||
| CVE-2026-109194 | 1 Redhat | 1 Quay | 2026-10-13 | 6.4 Medium |
| A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build triggers and associated write tokens of another repository if they know the victim trigger's universally unique identifier (UUID). | ||||