Export limit exceeded: 407196 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 407196 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (407196 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108866 | 1 Jeecg | 2 Jeecg-boot, Jeecg Boot | 2026-10-13 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user's complete permission set and identify administrator accounts. | ||||
| CVE-2026-108861 | 1 Erpipe-org | 1 Odoo Mcp | 2026-10-13 | 4.3 Medium |
| Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method naming denied fields to receive their values unredacted. | ||||
| CVE-2026-108856 | 1 Unicomai | 1 Wanwu | 2026-10-13 | 4.2 Medium |
| UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticated users to mint AppKeys bound to other users' MCP servers via POST /v1/appspace/app/key. Attackers supplying a victim's MCP server UUID with appType mcpserver can open MCP sessions and invoke the server's tools using the victim's upstream authentication. | ||||
| CVE-2026-108851 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-10-13 | 3.3 Low |
| phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search tool that allows MCP clients to read restricted FAQs because Search::searchDatabase() never applies user or group permission checks. Attackers connected to the phpmyfaq:mcp:server can issue search queries to retrieve the full question and answer text of active FAQs restricted to specific users or groups. | ||||
| CVE-2026-108775 | 1 Jeewms | 1 Jeewms | 2026-10-13 | 6.3 Medium |
| A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is the function WvNoticeController.list of the file com/zzjee/wmapi/controller/WvNoticeController.java of the component Search Endpoint. The manipulation of the argument searchstr leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108770 | 1 Appwrite | 1 Appwrite | 2026-10-13 | 5.3 Medium |
| A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to resolve this issue. Patch name: 393255e7302ae5503331d45802e2eee01c6a47fe. You should upgrade the affected component. | ||||
| CVE-2026-108756 | 2 Abilityai, Trinity Project | 2 Trinity, Trinity | 2026-10-13 | 5.4 Medium |
| Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token, replace the binding with their own token, or delete it. | ||||
| CVE-2026-108751 | 1 Modu-ai | 1 Moai-adk | 2026-10-13 | 4.4 Medium |
| MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so atomicWriteFile truncates and overwrites victim-writable files with MoAI template content. | ||||
| CVE-2026-108746 | 1 Vearch | 1 Vearch | 2026-10-13 | 8.8 High |
| Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access. | ||||
| CVE-2026-108740 | 1 Arp242 | 1 Goatcounter | 2026-10-13 | 8.3 High |
| GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access. | ||||
| CVE-2026-108735 | 1 Miniflux Project | 1 Miniflux | 2026-10-13 | 4.3 Medium |
| Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services. | ||||
| CVE-2026-108730 | 1 The-commit-company | 1 Raven | 2026-10-13 | 4.3 Medium |
| Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authenticated non-members can call get_messages_with_dates or get_all_files_shared_in_channel with predictable channel IDs to read Public channel history and Open/Public channel file metadata across workspaces. | ||||
| CVE-2026-108725 | 1 Cheshire-cat-ai | 1 Core | 2026-10-13 | 5.4 Medium |
| Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/{path} URL to a signed-in victim, executing script in the application origin with the victim's access_token cookie, including administrators. | ||||
| CVE-2026-108720 | 1 Phpipam | 1 Phpipam | 2026-10-13 | 4.3 Medium |
| phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::check_permission. Attackers can open customer objects.php, single-location.php or nat_details.php to read IP addresses, CIDRs, hostnames and MAC addresses from sections they cannot access. | ||||
| CVE-2026-108715 | 1 Librenms | 1 Librenms | 2026-10-13 | 4.3 Medium |
| LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokeping_in or smokeping_out graphs with arbitrary device ids to view latency data and enumerate device names. | ||||
| CVE-2026-108710 | 1 Orneryd | 1 Nornicdb | 2026-10-13 | 6.5 Medium |
| NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied read can submit search queries or node IDs to retrieve node IDs, labels and full property maps. | ||||
| CVE-2026-108697 | 1 Coreshop | 1 Coreshop | 2026-10-13 | 4.3 Medium |
| CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403() check. Authenticated Pimcore users lacking resource permissions can request the generated list routes to enumerate payment providers, carriers, price rules, stores, and tax rules including ids, names, and identifiers. | ||||
| CVE-2026-108683 | 1 Zhayujie | 1 Cowagent | 2026-10-13 | 4.3 Medium |
| A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 is sufficient to resolve this issue. The name of the patch is b7967210268fc4c0afea1078223e74e7e96a8a54. You should upgrade the affected component. | ||||
| CVE-2026-108578 | 1 Neterbit | 2 Nw-431f, Nw-431f Router | 2026-10-13 | 5.3 Medium |
| A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-105052 | 1 Ibm | 1 Maximo Application Suite | 2026-10-13 | 7.5 High |
| IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. | ||||