Export limit exceeded: 424234 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424234 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424234 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-54349 | 1 Chartbrew | 1 Chartbrew | 2026-11-09 | 9.8 Critical |
| Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.1, SQL dashboard-variable substitution used attacker-controlled JavaScript replacement strings unsafely across SQL connectors and separately failed to escape backslashes for MySQL and MariaDB quoted contexts. The vulnerable surface is public and embedded dashboard/chart requests that call applyMysqlOrPostgresVariables. An unauthenticated user sends crafted URL filter values to a public or embedded chart backed by a stored SQL query. Replacement-string dollar sequences can alter SQL independently of the database engine, while MySQL and MariaDB backslash handling provides a second quoted-string escape path. The target must expose a public or embedded chart using URL-controlled variables in a SQL query; only the backslash branch is specific to MySQL and MariaDB. Injected SQL can read, modify, or delete data available to the configured database account. This issue is fixed in version 5.2.1. | ||||
| CVE-2026-39733 | 2026-11-09 | 5.3 Medium | ||
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in properfraction ProfilePress wp-user-avatar allows Code Injection.This issue affects ProfilePress: from n/a through 4.17.7. | ||||
| CVE-2026-18836 | 1 Ibm | 1 Api Connect | 2026-11-09 | 9.3 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. The affected component can be made to send requests to unintended destinations and return the response to the attacker. | ||||
| CVE-2026-17404 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8.5 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. | ||||
| CVE-2026-17394 | 1 Ibm | 1 Api Connect | 2026-11-09 | 9.6 Critical |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improperly controlled modification of object attributes. A user-supplied value could change an access-related setting that should be controlled by the system, which could expose sensitive information. | ||||
| CVE-2026-17388 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8.5 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. | ||||
| CVE-2026-17386 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8.1 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote attacker to gain full administrative control due to the use of a cryptographically weak pseudo-random number generator. | ||||
| CVE-2026-17381 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8.5 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys. | ||||
| CVE-2026-17343 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8.1 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization. | ||||
| CVE-2026-17338 | 1 Ibm | 1 Api Connect | 2026-11-09 | 9.1 Critical |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. | ||||
| CVE-2026-17333 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation. | ||||
| CVE-2026-17328 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Input checks are incomplete, which could allow them to be bypassed. | ||||
| CVE-2026-17313 | 1 Ibm | 1 Api Connect | 2026-11-09 | 9.8 Critical |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and take control of gateway configuration due to authentication bypass via an alternate path. | ||||
| CVE-2026-17308 | 1 Ibm | 1 Api Connect | 2026-11-09 | 6.8 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation. | ||||
| CVE-2026-17228 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Destination restrictions on outbound requests can be bypassed, which could allow the server to retrieve content from unintended resources. | ||||
| CVE-2026-17167 | 1 Ibm | 1 Api Connect | 2026-11-09 | 4.3 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to falsify audit log information due to reliance on untrusted inputs. Information supplied by the client is relied on when recording the source of a request, so audit records could contain inaccurate details. | ||||
| CVE-2026-17139 | 1 Ibm | 1 Api Connect | 2026-11-09 | 5.4 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session. | ||||
| CVE-2026-17129 | 1 Ibm | 1 Api Connect | 2026-11-09 | 7.6 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference. | ||||
| CVE-2026-124316 | 1 Frappe | 1 Erpnext | 2026-11-09 | 4.3 Medium |
| Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can supply item codes to retrieve open Purchase-type Material Requests belonging to other companies. | ||||
| CVE-2026-124060 | 1 Totolink | 2 Ca300-poe, Ca300-poe Firmware | 2026-11-09 | 9.1 Critical |
| A vulnerability was detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used. | ||||