Export limit exceeded: 410159 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 410159 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 410159 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410159 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-111626 | 1 Webreaper | 1 Damselfly | 2026-10-19 | 9.8 Critical |
| Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control. | ||||
| CVE-2026-111660 | 1 Wayn111 | 1 Waynboot-mall | 2026-10-19 | 6.5 Medium |
| waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels. | ||||
| CVE-2026-111661 | 1 Wayn111 | 1 Waynboot-mall | 2026-10-19 | 5.3 Medium |
| waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion. | ||||
| CVE-2026-111664 | 1 Safing | 1 Portmaster | 2026-10-19 | 4.4 Medium |
| Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses version checks and auto-apply settings, installing older Safing-signed releases carrying previously fixed vulnerabilities. | ||||
| CVE-2026-111668 | 1 Beizhu-1209 | 1 Aihelms | 2026-10-19 | 5.4 Medium |
| AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports. | ||||
| CVE-2026-111669 | 1 Izhaorui | 1 Zr.admin.net | 2026-10-19 | 6.5 Medium |
| ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques. | ||||
| CVE-2026-111670 | 1 Clickvisual | 1 Clickvisual | 2026-10-19 | 4.3 Medium |
| ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables. | ||||
| CVE-2026-111674 | 1 Hello-hao | 1 Tbed | 2026-10-19 | 4.3 Medium |
| Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names with attacker-chosen text attributed to the victim. | ||||
| CVE-2026-111676 | 2 Faveosuite, Ladybirdweb | 2 Faveo-helpdesk, Faveo Helpdesk | 2026-10-19 | 4.3 Medium |
| Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes. | ||||
| CVE-2026-111677 | 1 Adri Van Os | 1 Antiword | 2026-10-19 | 5.5 Medium |
| Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap allocation that crash the process. | ||||
| CVE-2026-69999 | 1 Microsoft | 11 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 8 more | 2026-10-19 | 5.5 Medium |
| Out-of-bounds read in Windows Update allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-111678 | 1 Adri Van Os | 1 Antiword | 2026-10-19 | 3.3 Low |
| Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiword or corrupting style parsing. | ||||
| CVE-2026-111679 | 1 Ekkolearnai | 1 Ekko-studio | 2026-10-19 | 5.4 Medium |
| Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against super_admin accounts. | ||||
| CVE-2026-111681 | 1 Smartloli | 1 Efak | 2026-10-19 | 8.8 High |
| EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters. | ||||
| CVE-2026-111682 | 1 Smartloli | 1 Efak | 2026-10-19 | 6.5 Medium |
| EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs. | ||||
| CVE-2026-111690 | 1 Suyuan32 | 1 Simple-admin-core | 2026-10-19 | 9.8 Critical |
| Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens. | ||||
| CVE-2026-111691 | 1 Wimoor-erp | 1 Wimoor | 2026-10-19 | 7.4 High |
| WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations. | ||||
| CVE-2026-111692 | 1 Databufflabs | 1 Databuff | 2026-10-19 | 9.8 Critical |
| DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API. | ||||
| CVE-2026-111720 | 1 Lhccong | 1 Fish-island-backend | 2026-10-19 | 5.3 Medium |
| fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch attacker-supplied URLs via the url parameter of GET /api/web/parse. Attackers can target internal hosts, loopback services or cloud metadata endpoints through redirect-following OkHttp requests and read back page titles, meta descriptions and favicons. | ||||
| CVE-2026-111721 | 1 Jingsewu | 1 Open-wes | 2026-10-19 | 5.4 Medium |
| Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses. | ||||