Export limit exceeded: 400945 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (400945 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-104468 | 1 Yeswiki | 1 Yeswiki | 2026-10-02 | 4.8 Medium |
| YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links because tokens lack expiry timestamps. Attackers who obtain an unused reset URL from mailboxes, logs, backups, or browser history can submit a new password through checkEmailKey() and take over accounts. | ||||
| CVE-2026-104464 | 1 Yeswiki | 1 Yeswiki | 2026-10-02 | 8.6 High |
| YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requests by supplying an unvalidated actor URL to the Bazar abonnements sync action. Attackers can target internal hosts or cloud metadata endpoints and chain attacker-controlled outbox first/next links, with fetched responses stored as readable Bazar entries. | ||||
| CVE-2026-104462 | 1 Yeswiki | 1 Yeswiki | 2026-10-02 | 7.5 High |
| YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute into a raw SQL IN clause. Attackers with page-write access (unauthenticated on default installs) can embed a nuagetag tag ending in a backslash to break quote parity and inject a UNION subquery, exfiltrating password hashes and arbitrary table data. | ||||
| CVE-2026-104460 | 1 Yeswiki | 1 Yeswiki | 2026-10-02 | 7.5 High |
| YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concatenated into SQL REGEXP/LIKE clauses in actions/newtextsearch.php without escaping. Anonymous attackers can plant a malicious option id in an anonymously editable Bazar list and use search requests as a boolean oracle to read arbitrary database data, including admin password hashes from the yeswiki_users table. | ||||
| CVE-2026-104458 | 1 Yeswiki | 1 Yeswiki | 2026-10-02 | 6.5 Medium |
| YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to bypass the SSRF guard using 6to4, NAT64, or IPv4-compatible IPv6 addresses. Attackers can send a crafted Signature keyId to the public actor inbox route to reach cloud metadata, loopback services, or internal hosts. | ||||
| CVE-2026-104454 | 1 Yeswiki | 1 Yeswiki | 2026-10-02 | 5.3 Medium |
| YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. Unauthenticated attackers can submit a small crafted body of bracket characters to the page-edit preview endpoint to pin PHP-FPM workers and saturate the pool. | ||||
| CVE-2026-104450 | 1 Yeswiki | 1 Yeswiki | 2026-10-02 | 6.5 Medium |
| YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves content to an attacker-chosen page with write ACL checks bypassed. Unauthenticated attackers can POST pagetag, title, and description fields to any page rendering {{pointimage}} to append raw HTML or JavaScript to any wiki page, including pages whose write ACL restricts editing, causing stored cross-site scripting in viewers' and administrators' browsers. | ||||
| CVE-2026-104448 | 1 Yeswiki | 1 Yeswiki | 2026-10-02 | 8.1 High |
| YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on any GET request carrying a jsonp_callback parameter without checking a CSRF token. Attackers can lure a logged-in administrator or page owner to a crafted link to delete arbitrary pages along with their ACLs, links, triples, comments and referrers. | ||||
| CVE-2026-104446 | 1 Yeswiki | 1 Yeswiki | 2026-10-02 | 6.5 Medium |
| YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email through the wiki's SMTP server. Attackers can POST an XMLHttpRequest to the mail handler without field or type parameters, supplying arbitrary recipient, sender, subject and body for spam and phishing. | ||||
| CVE-2026-104440 | 1 Yeswiki | 1 Yeswiki | 2026-10-02 | 5.3 Medium |
| YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary server-side requests via the idtypeannonce parameter of /api/entries/bazarlist. Because isValidURL() always returns true, attackers can supply internal URLs fetched by curl in loadURLContent() to probe internal networks and reach internal services or metadata endpoints. | ||||
| CVE-2026-104436 | 2 Zcashfoundation, Zfnd | 2 Zebra, Zebra | 2026-10-02 | 3.7 Low |
| Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance. | ||||
| CVE-2026-104431 | 2 Zcashfoundation, Zfnd | 2 Zebra, Zebra | 2026-10-02 | 7.5 High |
| Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool transactions requiring expensive synchronous script verification. Attackers can send non-standard high-sigop P2SH transactions that reach CachedFfiTransaction::is_valid() before standardness checks, saturating the verifier buffer and rendering the node unresponsive. | ||||
| CVE-2026-104900 | 1 Misp | 1 Misp | 2026-10-02 | N/A |
| MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field template escaped the associated link URL but rendered the field value without HTML encoding. An attacker with the ability to create or modify events on a linked (remote) MISP server could craft an event identifier containing HTML or JavaScript markup. When a user on the local MISP instance views the remote event preview index, the unescaped value is rendered directly in the browser, allowing arbitrary script execution in the victim's session. Preconditions: - A linked/remote MISP server is configured and connected to the local instance. - The attacker has sufficient access on the linked server to create or modify an event with a crafted identifier. - A victim user on the local instance views the remote event preview index page. Impact: - Execution of arbitrary JavaScript in the context of the MISP web application. - Potential session hijacking, data exfiltration, or unauthorized actions performed on behalf of the authenticated user. Affected versions: <2.5.48. | ||||
| CVE-2026-87902 | 1 Wordpress | 1 Wordpress | 2026-10-02 | 8.1 High |
| An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE. | ||||
| CVE-2026-95285 | 1 Google | 1 Chrome | 2026-10-02 | 8.4 High |
| Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-96990 | 1 Apache | 1 Thrift | 2026-10-02 | N/A |
| Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue. | ||||
| CVE-2026-96294 | 1 Apache | 1 Thrift | 2026-10-02 | N/A |
| Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue. | ||||
| CVE-2026-85087 | 1 Apache | 1 Thrift | 2026-10-02 | N/A |
| Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue. | ||||
| CVE-2026-94544 | 2026-10-02 | N/A | ||
| Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an editor's Draft Mode fill, while an overlapping Draft Mode request can receive published content from a regular fill. When the regular request prerenders a page, the draft-dependent content can persist in the generated page and be served to later visitors until revalidation. Sites are affected when Cache Components or experimental.useCache is enabled and cached functions return draft-dependent content. This issue is fixed in version 16.3.8. | ||||
| CVE-2026-95374 | 1 Google | 1 Chrome | 2026-10-02 | 6.5 Medium |
| Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||