Export limit exceeded: 408478 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408478 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109352 | 1 Librenms | 1 Librenms | 2026-10-15 | 6.1 Medium |
| LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensor_descr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored device's SNMP agent can set values such as AI-AP-MIB::aiSSID to malicious JavaScript that executes when authenticated users view the device's Wireless tab, enabling session hijacking. | ||||
| CVE-2026-109347 | 1 Adminer | 1 Adminer | 2026-10-15 | 7.2 High |
| Adminer before 6.1.1 contains a remote code execution vulnerability that allows authenticated SQLite users to bypass ATTACH and VACUUM INTO restrictions by prefixing statements with a UTF-8 byte-order mark. Attackers can attach a database file at a PHP-served path and create a table named with PHP code to execute it as the web server user. | ||||
| CVE-2026-109342 | 1 Surrealdb | 1 Surrealdb | 2026-10-15 | 5.4 Medium |
| SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or unauthenticated callers to invalidate other users' refresh tokens without proof of possession. Attackers can obtain grant identifiers via ACCESS SHOW ALL with VIEWER permission or leaked tokens, then permanently revoke refresh tokens to force re-authentication. | ||||
| CVE-2026-109337 | 1 Surrealdb | 1 Surrealdb | 2026-10-15 | 4.3 Medium |
| SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level SELECT permissions using LIVE SELECT WHERE predicates over $before or $after. Attackers can craft repeated predicates and observe whether notifications are delivered on CREATE, UPDATE, or DELETE to confirm or narrow restricted field values. | ||||
| CVE-2026-109332 | 1 Network-ai | 1 Network-ai | 2026-10-15 | 3.1 Low |
| Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts that reflects localhost Origins into Access-Control-Allow-Origin regardless of bind interface. When the server binds a non-loopback address, an attacker page with a localhost Origin visited by a victim can read unauthenticated endpoints like /health cross-origin. | ||||
| CVE-2026-109327 | 1 Admidio | 1 Admidio | 2026-10-15 | 6.1 Medium |
| Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript: URL containing a decoy http:// segment that passes validation and executes script in the Admidio origin when victims click the redirect link. | ||||
| CVE-2026-109322 | 1 Getgrav | 1 Grav-plugin-guestbook | 2026-10-15 | 6.1 Medium |
| Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other visitors' browsers and, in versions 0.5.0 and 0.5.1, in administrator moderation sessions. | ||||
| CVE-2026-109317 | 1 Getgrav | 1 Grav-plugin-api | 2026-10-15 | 7.2 High |
| Grav grav-plugin-api before 1.0.36 contains a privilege escalation vulnerability that allows delegated user managers to obtain super-admin access by storing positive scalar admin or api parent grants. Attackers with api.users.write can edit account access maps or invitations so the inheriting permission resolver satisfies requireSuper checks, accessing super-only API endpoints. | ||||
| CVE-2026-109312 | 1 Getgrav | 1 Grav-plugin-login | 2026-10-15 | 8.1 High |
| Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists but not that a pending front-end 2FA session is fully authorized. Attackers with a victim's password who can publish a page form without an access rule can invoke update_user before completing 2FA to disable twofa_enabled and take over the account. | ||||
| CVE-2026-109307 | 1 Craftcms | 1 Craft Cms | 2026-10-15 | 4.7 Medium |
| Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a crafted /admin/login?verify=1 URL between password submission and TOTP verification, executing JavaScript in the authenticated control panel with the victim's permissions. | ||||
| CVE-2026-109302 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-10-15 | 3.7 Low |
| Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 applies its GraphQL introspection control only to operation text sent directly with a request, not to operations resolved from Apollo Server's automatic persisted query cache. Unauthenticated attackers holding the public Application Id and client key can replay an introspection query previously cached by a master or maintenance key client to retrieve the schema, including private class and field names. | ||||
| CVE-2026-109297 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-10-15 | 6.5 Medium |
| Open WebUI 0.11.0 before 0.11.4 contains a denial of service vulnerability in the automation recurrence-rule validator, whose sub-daily frequency guard parses rule text more strictly than the calendar library that executes it. Users permitted to create automations can submit whitespace-folded rules (or, in 0.11.0, lowercase frequencies or omitted RRULE prefixes) that expand per-second synchronously, blocking the shared event loop for minutes per request and on every scheduler poll. | ||||
| CVE-2026-109292 | 1 Openwebui | 1 Open Webui | 2026-10-15 | 6.8 Medium |
| Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session cookies by receiving the full browser cookie jar on OAuth-mode connections. Operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers can capture forwarded session cookies from routine requests and replay them to hijack accounts, including administrators. | ||||
| CVE-2026-109287 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-10-15 | 4.3 Medium |
| Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied directory_id belongs to the requested knowledge base. Users with read access to any knowledge base can supply a retained foreign directory UUID to GET /api/v1/knowledge/{id}/files. The returned breadcrumbs expose folder names, owner user ids and knowledge base ids of that directory and all its ancestors. | ||||
| CVE-2026-109282 | 1 Imagemagick | 1 Imagemagick | 2026-10-15 | 2.5 Low |
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a type confusion flaw in the INFO, JSON and YAML encoders, where an internal method receives a pointer of an unexpected type when writing an image in a compressed format. An attacker who can cause such an image write can trigger a SIGABRT or SIGSEGV, crashing the process and causing denial of service. | ||||
| CVE-2026-109277 | 1 Imagemagick | 1 Imagemagick | 2026-10-15 | 3.3 Low |
| ImageMagick before 7.1.2-32 contains a policy bypass vulnerability in the -script operation due to missing checks on file descriptor handling. Attackers can use the -script operation to close file descriptors not opened by the current operation, circumventing configured security policies. | ||||
| CVE-2026-109272 | 1 Imagemagick | 1 Imagemagick | 2026-10-15 | 3.7 Low |
| ImageMagick 7.1.1-31 before 7.1.2-32 contains a NULL pointer dereference in the PostScript decoder that is triggered when a policy limit is reached. Attackers can supply a crafted PostScript file for processing to crash the application, causing a denial of service. | ||||
| CVE-2026-109267 | 1 Imagemagick | 1 Imagemagick | 2026-10-15 | 5.3 Medium |
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL decoder caused by an incorrect depth check that fails to limit recursion. Attackers can supply a set of crafted MSL images that exhaust the stack when one of them is read, crashing the process and causing a denial of service. | ||||
| CVE-2026-109262 | 1 Imagemagick | 1 Imagemagick | 2026-10-15 | 5.3 Medium |
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a memory leak in the SVG encoder (WriteSVGImage) that fails to release allocated memory when handling crafted images. Attackers can supply crafted image files that are processed by the SVG encoder to leak memory and cause a denial of service through resource consumption. | ||||
| CVE-2026-109257 | 1 Freerdp | 1 Freerdp | 2026-10-15 | 5.9 Medium |
| FreeRDP before 3.32.0 contains a double-free vulnerability in nsc_context_initialize_encode() that leaves dangling plane pointers after a partial buffer growth failure. Attackers using a crafted RDP client can negotiate NSCodec with a large desktop geometry to trigger allocation failure, crashing the server during context teardown. | ||||