Export limit exceeded: 420868 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 16423 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16423 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119651 | 1 Hulaspark | 1 Hula-server | 2026-11-04 | 5.4 Medium |
| HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated users to delete other users' moments by supplying arbitrary feedId values. Attackers can send POST requests to /feed/del with another user's feedId to delete their moments along with associated media, comments, and likes. | ||||
| CVE-2026-119647 | 1 Dromara | 1 Ruoyi-vue-plus | 2026-11-04 | 4.3 Medium |
| RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authenticated users to read users of other departments. Users holding system:user:list under a department-restricted role can request GET /system/user/list/dept/{deptId} with any department id to obtain usernames, nicknames, account status, last login IP and time, and remarks. | ||||
| CVE-2026-119596 | 1 Hdinnovations | 1 Unit3d | 2026-11-04 | 4.3 Medium |
| UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to download other members' private playlists. Attackers can enumerate sequential playlist ids at the /playlist-zips/{playlist} endpoint to obtain zips of all torrents, disclosing private collection membership. | ||||
| CVE-2026-119591 | 2 Redhat, Sqlite | 2 Hummingbird, Sqlite | 2026-11-04 | 5.5 Medium |
| SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service. | ||||
| CVE-2026-119571 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-11-04 | 3.7 Low |
| Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to the installation named in the X-Parse-Installation-Id header. When protectedFieldsTriggerExempt is enabled, attackers knowing another installation's object ID can make a beforeSave trigger process that installation's protected fields while writing elsewhere. | ||||
| CVE-2026-112348 | 2 Themeum, Wordpress-extensions | 2 Kirki, Kirki | 2026-11-04 | 6.5 Medium |
| Kirki plugin for WordPress before 6.2.5 contains a reCAPTCHA bypass vulnerability that allows unauthenticated attackers to submit frontend forms without valid verification by omitting the g-recaptcha-token field from POST requests to the form submission endpoint. Attackers can exploit the verify() method's early return on empty token values to submit unlimited forms, triggering notification emails, webhooks, and unbounded writes to the submissions table without completing reCAPTCHA validation. | ||||
| CVE-2026-121747 | 1 Nvm-sh | 1 Nvm | 2026-11-04 | 5.5 Medium |
| Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.2.0 through 0.40.8, nvm does not check whether `.nvmrc` is a symbolic link. A repository or archive that ships `.nvmrc` as a symlink to another file (for example `../../.npmrc`, or `/proc/self/environ` on Linux) makes a plain `nvm use`, `nvm install`, `nvm which`, `nvm exec`, `nvm run`, or `nvm-exec` read that file and print its contents in the invalid-`.nvmrc` message (even with `--silent`) or, for a one-line file, in the `Found ... with version <...>` message; with the README's zsh `load-nvmrc` or bash `cdnvm` hook installed, entering the directory is enough. nvm sends the content nowhere; the attacker learns it only where they can see the victim's output, such as a CI log for a contributed branch. Version 0.41.0 still follows a symlinked `.nvmrc`, so deliberate links to another version file keep working, but never prints its content, and accepts it only if it contains a version or the name of an existing alias; the README's bash `cdnvm` hook, which read `.nvmrc` itself, now gets the version from nvm, so users of that hook must also update their copy of it. | ||||
| CVE-2026-42010 | 2 Gnu, Redhat | 18 Gnutls, Ai Inference Server, Cert Manager and 15 more | 2026-11-04 | 7.1 High |
| A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process. | ||||
| CVE-2025-3155 | 3 Debian, Gnome, Redhat | 26 Debian Linux, Yelp, Codeready Linux Builder and 23 more | 2026-11-04 | 7.4 High |
| A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment. | ||||
| CVE-2026-13601 | 2 Gnome, Redhat | 8 Yelp, Enterprise Linux, Rhel Aus and 5 more | 2026-11-04 | 7.1 High |
| A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information. | ||||
| CVE-2026-112177 | 2 Ghostscript, Redhat | 3 Ghostscript, Enterprise Linux, Rhel Els | 2026-11-04 | 7.3 High |
| A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process. | ||||
| CVE-2026-93434 | 1 Watchguard | 1 Fireware Os | 2026-11-04 | N/A |
| An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with access to the management SSH interface to extract sensitive configuration data by submitting a specially crafted request. | ||||
| CVE-2026-16307 | 1 Netiket Information Technologies | 1 Edoweb | 2026-11-04 | 4.3 Medium |
| Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7. | ||||
| CVE-2026-119748 | 2026-11-04 | 6.5 Medium | ||
| The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to access and manipulate another user's invoice by supplying its ID through the maybe_use_invoice parameter in process_invoice(), bypassing the ownership and key checks performed by is_authorized_to_pay(). Attackers can submit a known pending invoice ID via maybe_use_invoice to read checkout pricing details and initiate a checkout workflow, resulting in an unauthorized state change of the invoice to on-hold. | ||||
| CVE-2026-116214 | 2 Maccms, Magicblack | 2 Maccms, Maccms10 | 2026-11-04 | 9.1 Critical |
| MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because check_msg() never compares msg_to. Attackers can request a recovery code to their own mailbox via user/findpass_msg, then submit it to user/findpass_reset with the victim's email or phone to take over the account. | ||||
| CVE-2026-115334 | 1 Uselotus | 1 Lotus | 2026-11-04 | 6.8 Medium |
| Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows authenticated users to join any organization by supplying its UUID. Self-registered attackers who know another organization's UUID can send a POST request to /app/switch_organization/ to access that tenant's data and billing configuration. | ||||
| CVE-2026-108331 | 1 Tanium | 2 Endpoint Configuration Toolset Solution, Threat Response | 2026-11-04 | 3.3 Low |
| Tanium addressed an infinite loop vulnerability in Threat Response Client Extension. | ||||
| CVE-2026-108142 | 1 Veeam | 1 Backup And Replication | 2026-11-04 | N/A |
| A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service. | ||||
| CVE-2024-3019 | 1 Redhat | 6 Enterprise Linux, Rhel Aus, Rhel E4s and 3 more | 2026-11-04 | 8.8 High |
| A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be started manually. The pmproxy service is usually started from the 'Metrics settings' page of the Cockpit web interface. This flaw affects PCP versions 4.3.4 and newer. | ||||
| CVE-2023-6291 | 1 Redhat | 18 Build Keycloak, Enterprise Linux, Jboss Bpms and 15 more | 2026-11-04 | 7.1 High |
| A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users. | ||||