Export limit exceeded: 412929 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412929 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-55543 | 1 Helge17 | 1 Tuxguitar | 2026-10-19 | N/A |
| TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive, including the .tg file itself, whose META-INF/services/javax.sound.midi.Soundbank entry names an attacker-supplied class stored in that archive. When a user opens the file, JARSoundbankReader uses an unverified class loader to load and instantiate that class, executing its constructor with the privileges of the TuxGuitar process. This issue is fixed in version 2.1.0. | ||||
| CVE-2026-96424 | 1 Ubports | 1 Lomiri-download-manager | 2026-10-19 | 7.8 High |
| Incorrect DBus policy for lomiri-upload-manager (part of lomiri-download-manager) allows arbitrary user to read arbitrary file as root over DBus | ||||
| CVE-2026-96425 | 1 Ubports | 1 Lomiri-download-manager | 2026-10-19 | 5.5 Medium |
| Incorrect DBus policy for lomiri-download-manager allows arbitrary user to run arbitrary command as root over DBus | ||||
| CVE-2026-62362 | 1 Pbh-btn | 1 Peerbanhelper | 2026-10-19 | 4.9 Medium |
| PeerBanHelper automatically blocks unwanted, leeching, and abnormal BitTorrent peers using customizable and cloud rules. From 5.0.0 until 9.3.15, the /api/statistic/analysis/field endpoint accepts a crafted field query parameter from an authenticated user and passes it to countField or sumField. The mapField() method forwards unrecognized field names without sanitization, so unrecognized field names are interpolated into SQL through ${field} across the SQLite, MySQL, and PostgreSQL mappers. Successful exploitation can read all data in the PeerBanHelper database. This issue is fixed in version 9.3.15. | ||||
| CVE-2026-111612 | 1 Qaiu | 1 Netdisk-fast-download | 2026-10-19 | 7.5 High |
| netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly call the endpoint and decrypt the encryptedAuth blob using the hard-coded AES key nfd_auth_key2026 to recover other users' cloud-drive cookies, tokens, or passwords. | ||||
| CVE-2026-111616 | 1 Oqtane | 1 Oqtane Framework | 2026-10-19 | 4.9 Medium |
| Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site can request another site's entityId through their own alias to retrieve stored SMTPPassword and SMTPClientSecret values. | ||||
| CVE-2026-111617 | 1 Mgdaaslab | 1 Wharttest | 2026-10-19 | 6.5 Medium |
| WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. Attackers can register an actuator with a client-supplied id to intercept other users' test-case payloads, receive broadcast step results, and spoof results and screen frames into victim sessions. | ||||
| CVE-2026-111618 | 1 Coaidev | 1 Coai | 2026-10-19 | 5.3 Medium |
| CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any readable .tar.gz or .zip file, including other users' generated archives. | ||||
| CVE-2026-111623 | 1 Joey-zhou | 1 Xiaozhi-esp32-server-java | 2026-10-19 | 5.6 Medium |
| Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting /api/device/ota with any MAC address. Attackers can open a victim device's WebSocket channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata. | ||||
| CVE-2026-111626 | 1 Webreaper | 1 Damselfly | 2026-10-19 | 9.8 Critical |
| Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control. | ||||
| CVE-2026-111661 | 1 Wayn111 | 1 Waynboot-mall | 2026-10-19 | 5.3 Medium |
| waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion. | ||||
| CVE-2026-111668 | 1 Beizhu-1209 | 1 Aihelms | 2026-10-19 | 5.4 Medium |
| AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports. | ||||
| CVE-2026-111676 | 2 Faveosuite, Ladybirdweb | 2 Faveo-helpdesk, Faveo Helpdesk | 2026-10-19 | 4.3 Medium |
| Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes. | ||||
| CVE-2026-69999 | 1 Microsoft | 11 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 8 more | 2026-10-19 | 5.5 Medium |
| Out-of-bounds read in Windows Update allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-111681 | 1 Smartloli | 1 Efak | 2026-10-19 | 8.8 High |
| EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters. | ||||
| CVE-2026-111682 | 1 Smartloli | 1 Efak | 2026-10-19 | 6.5 Medium |
| EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs. | ||||
| CVE-2026-111691 | 1 Wimoor-erp | 1 Wimoor | 2026-10-19 | 7.4 High |
| WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations. | ||||
| CVE-2026-111692 | 1 Databufflabs | 1 Databuff | 2026-10-19 | 9.8 Critical |
| DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API. | ||||
| CVE-2026-111721 | 1 Jingsewu | 1 Open-wes | 2026-10-19 | 5.4 Medium |
| Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses. | ||||
| CVE-2026-111722 | 1 Lingguoai | 1 Lingguo-drama | 2026-10-19 | 8.1 High |
| LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects. | ||||