Export limit exceeded: 408207 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408207 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408207 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408207 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109654 | 1 Frappe | 1 Erpnext | 2026-10-13 | 5.4 Medium |
| Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to verify that the caller may read a document before sending transactional email about it. Authenticated attackers can call these endpoints to trigger transactional email for documents they are not permitted to read. | ||||
| CVE-2026-109649 | 1 Frappe | 1 Erpnext | 2026-10-13 | 6.5 Medium |
| Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers can send specially crafted requests to the affected endpoints to extract sensitive information from the database. | ||||
| CVE-2026-109644 | 1 Frappe | 1 Erpnext | 2026-10-13 | 6.5 Medium |
| Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation information beyond what their assigned role permits. | ||||
| CVE-2026-109639 | 1 Frappe | 1 Erpnext | 2026-10-13 | 6.5 Medium |
| Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validation, allowing manipulation of database queries. Authenticated attackers with low privileges can send specially crafted requests to the affected endpoints to extract sensitive information from the database. | ||||
| CVE-2026-109634 | 1 Frappe | 1 Erpnext | 2026-10-13 | 4.9 Medium |
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers with high privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the database. | ||||
| CVE-2026-109629 | 1 Frappe | 1 Erpnext | 2026-10-13 | 4.3 Medium |
| Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactional email through the site's configured outgoing account without checking the caller's authorization. Any authenticated user can supply arbitrary recipient lists and message content to send attacker-controlled messages carrying the organisation's sending identity. | ||||
| CVE-2026-109624 | 1 Frappe | 1 Erpnext | 2026-10-13 | 6.5 Medium |
| Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their assigned role permits. | ||||
| CVE-2026-109616 | 1 Frappe | 1 Erpnext | 2026-10-13 | 7.1 High |
| Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to these endpoints to modify data beyond what their assigned role permits. | ||||
| CVE-2026-109611 | 1 Frappe | 1 Erpnext | 2026-10-13 | 4.3 Medium |
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can call these endpoints to modify data beyond what their assigned role permits. | ||||
| CVE-2026-109603 | 1 Frappe | 1 Frappe | 2026-10-13 | 3.3 Low |
| Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, enabling server-side request forgery and local file inclusion. Authenticated attackers can supply crafted content to PDF rendering to make the server fetch internal resources or embed local server files in generated PDFs. | ||||
| CVE-2026-109598 | 1 Frappe | 1 Frappe | 2026-10-13 | 4.3 Medium |
| Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endpoint, which does not verify that the caller is permitted to send SMS messages. Users lacking the required permissions can invoke send_sms to send arbitrary SMS messages that impersonate the Company. | ||||
| CVE-2026-109573 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-13 | 8.1 High |
| phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NO_BACKSLASH_ESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search parameter of api/autocomplete, which is normalized to an ASCII quote, to read credentials and configuration secrets, modify records, or drop tables. | ||||
| CVE-2026-109570 | 1 Fire-boltt | 1 Bsw013 | 2026-10-13 | 4.3 Medium |
| Fire-Boltt BSW013 smartwatch firmware through V0.0.8 contains a missing authentication vulnerability that allows unpaired attackers to inject notifications by writing to the proprietary BLE command characteristic. Attackers within Bluetooth range can craft commands protected only by a CRC-16/ARC checksum to vibrate the watch and display spoofed alert text for phishing. | ||||
| CVE-2026-109155 | 1 Deeppavlov | 1 Deeppavlov | 2026-10-13 | 6.3 Medium |
| A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-109144 | 1 Wbond | 1 Certvalidator | 2026-10-13 | 5.3 Medium |
| A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the component Certificate Path Builder. Such manipulation leads to resource consumption. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-109114 | 1 Adithyayelloju | 1 Restaurant-management-system | 2026-10-13 | 7.3 High |
| A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper authentication. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-109107 | 1 Wavlink | 1 Wl-wn592ax6 | 2026-10-13 | 6.5 Medium |
| A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. This manipulation of the argument Cookie causes null pointer dereference. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-108973 | 1 Sourcecodester | 1 Contact Tracing System | 2026-10-13 | 7.3 High |
| A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of the file /classes/Users.php?f=save. This manipulation of the argument img/id causes unrestricted upload. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-108969 | 1 Itsmeravitejak | 1 Online-examination-system | 2026-10-13 | 7.3 High |
| A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-108965 | 1 Sourcecodester | 1 Performance Indicator System | 2026-10-13 | 7.3 High |
| A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_quantity.php. Executing a manipulation of the argument pqty can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. | ||||