Export limit exceeded: 425645 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 47567 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47567 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-104626 | 1 Gitea | 1 Gitea | 2026-10-13 | 8.8 High |
| A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs. | ||||
| CVE-2026-90460 | 1 Openstack | 1 Keystone | 2026-10-13 | N/A |
| An issue was discovered in OpenStack Keystone before 29.0.3. Tokens obtained via delegated authentication methods (EC2 credentials, application credentials, OAuth1 access tokens, and trusts) are not blocked from creating, modifying, or deleting credentials via the /v3/credentials API. EC2-derived tokens can additionally read credential blobs, exposing TOTP MFA seeds and other secrets. Also, PATCH /v3/credentials does not validate the requested post-update project_id, allowing any delegated token to move a credential to an unauthorized project. All Keystone deployments using delegated authentication are affected. | ||||
| CVE-2026-74035 | 1 Wazuh | 1 Wazuh | 2026-10-13 | 7.2 High |
| Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user guard and password policy inside a falsy truthiness check. A delegated user administrator can send an empty password to the user update endpoint, bypassing the reserved user guard to take over the wazuh superuser account and authenticate with empty credentials. | ||||
| CVE-2026-87669 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-13 | 4.3 Medium |
| A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite (MAPS) violation data across all logical switches. An attacker with low-privilege API access can leverage this endpoint to dump chassis-wide system health metrics, port performance violations, and configuration data without appropriate privileges. | ||||
| CVE-2026-109668 | 1 Frappe | 1 Erpnext | 2026-10-13 | 4.3 Medium |
| Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that handle party records, allowing authenticated users to modify data beyond their permitted role. Attackers with low-privileged accounts can send requests to these endpoints to make unauthorized changes to party records. | ||||
| CVE-2026-109663 | 1 Frappe | 1 Erpnext | 2026-10-13 | 6.5 Medium |
| Frappe ERPNext before 15.113.0 and 16.x before 16.22.0 contains an SQL injection vulnerability caused by missing input validation in some endpoints. Authenticated remote attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database. | ||||
| CVE-2026-109658 | 1 Frappe | 1 Erpnext | 2026-10-13 | 6.5 Medium |
| Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their assigned role permits. | ||||
| CVE-2026-109648 | 1 Frappe | 1 Erpnext | 2026-10-13 | 6.5 Medium |
| Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in some endpoints due to missing input validation. Authenticated attackers can send specially crafted requests to inject SQL into database queries and extract sensitive information from the underlying database. | ||||
| CVE-2026-109643 | 1 Frappe | 1 Erpnext | 2026-10-13 | 6.5 Medium |
| Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond what their assigned role permits. | ||||
| CVE-2026-109638 | 1 Frappe | 1 Erpnext | 2026-10-13 | 6.5 Medium |
| Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the database. | ||||
| CVE-2026-109628 | 1 Frappe | 1 Erpnext | 2026-10-13 | 6.5 Medium |
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond their permitted role, compromising data integrity. | ||||
| CVE-2026-109623 | 1 Frappe | 1 Erpnext | 2026-10-13 | 5.4 Medium |
| Frappe ERPNext before 15.121.1 and 16.x before 16.34.2 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated attackers can send requests to these endpoints to modify documents and data beyond what their assigned role permits. | ||||
| CVE-2026-109615 | 1 Frappe | 1 Erpnext | 2026-10-13 | 6.5 Medium |
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents against records beyond their permitted role, bypassing role-based access controls. | ||||
| CVE-2026-109610 | 1 Frappe | 1 Erpnext | 2026-10-13 | 6.5 Medium |
| Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their assigned role permits. | ||||
| CVE-2026-109572 | 1 Openwebui | 1 Open Webui | 2026-10-13 | 7.6 High |
| Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to reach the Terminals administrator API with the shared key attached. Attackers can send requests through /api/v1/terminals/{server_id}/{path} to list or stop other users' terminals and modify terminal policies, injecting environment variables into other users' terminals. | ||||
| CVE-2026-109559 | 1 Tianma-if | 1 Edgeever | 2026-10-13 | 8.7 High |
| EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window via string-prefix URL matching. Attackers can embed a link using userinfo syntax after the dev-server prefix, for example in a note-template preview, to obtain the edgeeverDesktop bridge including session token, sidecar RPC, and ACP channels. | ||||
| CVE-2026-109353 | 1 Librenms | 1 Librenms | 2026-10-13 | 7.1 High |
| LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notification_id parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in notifications_attribs and readable through the interface. | ||||
| CVE-2026-109333 | 1 Surrealdb | 1 Surrealdb | 2026-10-13 | 6.5 Medium |
| SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespace/database and name a known record id in a RETURN … FETCH query to read another tenant's data when table PERMISSIONS allow reads. | ||||
| CVE-2026-109319 | 1 Getgrav | 1 Grav-plugin-guestbook | 2026-10-13 | 4.3 Medium |
| Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permission, or external sites abusing a moderator's session via nonce-less GET requests, can delete or approve Guestbook entries. | ||||
| CVE-2026-109284 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-10-13 | 4.3 Medium |
| Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to read-only can call POST /api/v1/chats/{id}/fork on chats they created there while they had write access, inserting attacker-controlled chats visible to the folder owner and members. | ||||