Export limit exceeded: 407848 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (407848 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110122 | 1 Pickmall | 1 Lilishop | 2026-10-13 | 4.3 Medium |
| PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges. | ||||
| CVE-2026-110120 | 1 Guchengwuyue | 1 Yshopmall | 2026-10-13 | 5.4 Medium |
| Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' data by supplying their after-sales id and orderCode. Attackers can call deleteAfterSalesOrder, addLogisticsInformation, or GET /applyForAfterSales/{key} to view other members' order items and tamper with or delete their after-sales records. | ||||
| CVE-2026-110119 | 1 Guchengwuyue | 1 Yshopmall | 2026-10-13 | 7.1 High |
| Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and delete other members' shipping addresses. Attackers can enumerate sequential address ids via /address/detail/{id}, /address/del and /address/edit to expose recipient names, phone numbers and addresses, reassign them, or delete them. | ||||
| CVE-2026-110114 | 2026-10-13 | 6.5 Medium | ||
| FJ-OMS oms-erp through PRE contains a missing authentication vulnerability that allows unauthenticated attackers to delete and rebuild product search indexes by calling public es-test maintenance endpoints in skyer-goods. Attackers can repeatedly request /v1/goods/sku/es-test to empty the shared goods_sku_index_01 index for all tenants and force full-table reloads, degrading search availability. | ||||
| CVE-2026-110110 | 2026-10-13 | 4.3 Medium | ||
| JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack the save action annotation, attackers can toggle alarms by id to silence alerts for monitored devices. | ||||
| CVE-2026-110108 | 2026-10-13 | 8.1 High | ||
| MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-registered users can supply arbitrary bucket and objectName values to list objects, obtain pre-signed download URLs for other users' files, delete objects, and upload at chosen keys. | ||||
| CVE-2026-110107 | 2026-10-13 | 4.2 Medium | ||
| RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId}, which deletes sys_social rows by primary key without ownership checks, removing victims' OAuth tokens and blocking social login. | ||||
| CVE-2026-110106 | 1 Dromara | 1 Ruoyi-vue-plus | 2026-10-13 | 4.2 Medium |
| RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings by supplying their socialId. Attackers can send DELETE /auth/unlock/{socialId} requests with a victim's binding id to remove their GitHub, WeChat, or Gitee binding and stored OAuth tokens, blocking social login. | ||||
| CVE-2026-110105 | 1 B3log | 1 Symphony | 2026-10-13 | 5.3 Medium |
| B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can request /admin/report/ignore/{reportId}, /admin/tags/remove-unused, or /admin/user/{userId}/init-point to ignore reports, delete unused tags, or grant points without audit logging. | ||||
| CVE-2026-110103 | 1 Bbs-go Project | 1 Bbs-go | 2026-10-13 | 5.4 Medium |
| bbs-go through 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML or SVG files by spoofing the multipart Content-Type in POST /api/upload. Attackers can upload script-bearing documents served inline from /res and send their URLs to administrators, executing script on the forum's origin. | ||||
| CVE-2026-110101 | 1 Benjaminjonard | 1 Koillection | 2026-10-13 | 5.4 Medium |
| Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum file attachments lacking MIME restrictions. Attackers can upload HTML payloads via POST /api/data/{id}/file, served as text/html from public/uploads, executing JavaScript in victims' sessions to perform actions on their behalf. | ||||
| CVE-2026-110100 | 1 Jorani | 1 Jorani | 2026-10-13 | 5.4 Medium |
| Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse get_headers() and fopen() for server-side request forgery against internal hosts. | ||||
| CVE-2026-110098 | 1 Jorani | 1 Jorani | 2026-10-13 | 5.4 Medium |
| Jorani before 1.0.4 contains an insecure direct object reference vulnerability that allows authenticated users to modify, delete, and view other employees' requests by authorizing by operation name only. Attackers can supply numeric request ids to Leaves::edit(), Extra::edit(), Leaves::delete(), Extra::delete(), and Leaves::history() to tamper with colleagues' leave and overtime requests and read leave history. | ||||
| CVE-2026-110097 | 2026-10-13 | 8.1 High | ||
| Ikaros 1.2.0 through 1.2.5 contains an authentication bypass vulnerability that allows attackers with a valid password to skip TOTP verification by reusing the login temp token. Attackers can present the temp token from the jwt/apply endpoint as a bearer JWT, refresh it, or use HTTP Basic login to gain full account access, including the master administrator. | ||||
| CVE-2026-94603 | 1 Podman Project | 1 Podman | 2026-10-13 | 10 Critical |
| Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3. | ||||
| CVE-2026-79960 | 1 Gitea | 1 Gitea | 2026-10-13 | 7.1 High |
| When a push was authenticated with a deploy key, Gitea recorded the repository owner as the pusher, so permission checks in the push hook pipeline evaluated the owner instead of the deploy key. A holder of a writable deploy key could create protected tags without being on the tag allow list and change repository visibility through push options, for example making a private repository public. Pull requests created through the AGit flow with a deploy key were also attributed to the owner. | ||||
| CVE-2026-89430 | 1 Gitea | 1 Gitea | 2026-10-13 | 8.1 High |
| Gitea validated a push mirror's remote address against the `[migrations]` allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to `git push`, so a name that later resolved to a blocked or internal address was still reached. A user with administrator access to a repository, which includes repositories they create themselves, could aim push mirror synchronization at internal Git services and force-push the repository's contents to them. | ||||
| CVE-2026-67456 | 2026-10-13 | 4.4 Medium | ||
| NVIDIA Warp contains a vulnerability where an attacker could cause a heap-based buffer overflow. A successful exploit of this vulnerability might lead to denial of service. | ||||
| CVE-2026-65103 | 2026-10-13 | 8.1 High | ||
| NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target, resulting in the arbitrary creation or overwrite of a file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service. | ||||
| CVE-2026-65161 | 2026-10-13 | 7.5 High | ||
| NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure. | ||||