Export limit exceeded: 417602 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417602 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417602 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417602 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119706 | 1 Internlm | 1 Lmdeploy | 2026-10-30 | 9.8 Critical |
| InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows remote attackers to run OS commands by sending pickled data to the /update_weights endpoint. Attackers can submit a base64-encoded crafted pickle in serialized_named_tensors, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process. | ||||
| CVE-2026-119661 | 2 Showdoc, Star7th | 2 Showdoc, Showdoc | 2026-10-30 | 4.2 Medium |
| ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id first and append other users' entry ids to permanently delete those parameter-description entries. | ||||
| CVE-2026-119657 | 1 Zyx0814 | 1 Filepress | 2026-10-30 | 5 Medium |
| FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attackers who know another library's appid or folder id can invoke folder.php operations like deletefolder and rename, or rightdata.php getfolderdata, to delete, modify, or read foreign folders. | ||||
| CVE-2026-119649 | 1 Orchardcore | 1 Orchard Cms | 2026-10-30 | 7.1 High |
| Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, clone, and delete other users' media items by content id and delete arbitrary media folders via FolderController.Delete(). | ||||
| CVE-2026-119645 | 1 Easysoft | 1 Zentaopms | 2026-10-30 | 6.5 Medium |
| ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document ids to retrieve body and draft content of private documents and restricted library, product, project, or team documents. | ||||
| CVE-2026-119577 | 1 Arcadedata | 1 Arcadedb | 2026-10-30 | 6.8 Medium |
| ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connection can keep reading and writing data after deletion, grant removal, or password rotation, because executors keep a stale ServerSecurityUser. | ||||
| CVE-2026-119574 | 1 Traefik | 1 Traefik | 2026-10-30 | 5.9 Medium |
| Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated attackers to crash the process by abusing HTTP/1 protocol upgrades. Attackers can repeatedly open and abort upgraded connections such as WebSocket, corrupting the unsynchronized shared bufio.Reader and triggering an unrecovered panic that terminates Traefik. | ||||
| CVE-2026-119573 | 1 Traefik | 1 Traefik | 2026-10-30 | 4.4 Medium |
| Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users who can create Ingresses can reference another namespace's CA secret already used by another Ingress, enforcing it on their own routes and learning whether it exists, without disclosure of its contents. | ||||
| CVE-2026-119570 | 2 Parse Community, Parseplatform | 2 Parse Server, Parse-server | 2026-10-30 | 3.1 Low |
| Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to receive protected field values written by beforeSave triggers using dot notation keys. When protectedFieldsSaveResponseExempt is set to false, clients with create or update permission can read values a trigger writes beneath a protected field in the same request. | ||||
| CVE-2026-119568 | 1 Vsftpd Project | 1 Vsftpd | 2026-10-30 | 7.4 High |
| vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's source IP can obtain a ticket via AUTH TLS, then connect to the victim's PASV port to steal downloads or inject upload data. | ||||
| CVE-2026-119564 | 1 Plausible | 1 Plausible Analytics | 2026-10-30 | 5.3 Medium |
| Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register with the invitee's email using the exposed ID and accept it, gaining the invited role or taking site ownership. | ||||
| CVE-2026-119556 | 1 Moodle | 1 Moodle | 2026-10-30 | 4.3 Medium |
| Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade items. Authenticated course users can call the AJAX or mobile web service to list hidden grade item ids, names, and categories that the gradebook conceals from them. | ||||
| CVE-2026-119552 | 1 Uptime-kuma Project | 1 Uptime-kuma | 2026-10-30 | 4.8 Medium |
| Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcrypt hashing window to bypass the empty user table check, then modify monitors, API keys, and enable disableAuth. | ||||
| CVE-2026-119429 | 1 Phpmyadmin | 1 Phpmyadmin | 2026-10-30 | 4.3 Medium |
| phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password. | ||||
| CVE-2026-119425 | 1 Opnsense | 2 Core, Opnsense | 2026-10-30 | 5.4 Medium |
| OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observations. Attackers on the same Layer-2 segment can send forged gratuitous ARP replies binding their IP to a victim's MAC, gaining portal access with traffic attributed to the victim. | ||||
| CVE-2026-119417 | 1 Cakephp | 1 Cakephp | 2026-10-30 | 3.7 Low |
| CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incomplete fix for CVE-2026-77634. Attackers controlling custom headers set via Message::setHeaders() or Message::addHeaders() can insert a bare CR or LF to inject headers like Bcc, redirecting or altering outgoing mail. | ||||
| CVE-2026-119375 | 1 Sqlite | 1 Sqlite | 2026-10-30 | 5.5 Medium |
| SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers. | ||||
| CVE-2026-119374 | 1 Sqlite | 1 Sqlite | 2026-10-30 | 7.8 High |
| SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application. | ||||
| CVE-2026-119371 | 1 Sqlite | 1 Sqlite | 2026-10-30 | 5.5 Medium |
| SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process. | ||||
| CVE-2026-119369 | 2026-10-30 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2. | ||||