Export limit exceeded: 407440 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 407440 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (407440 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108770 | 1 Appwrite | 1 Appwrite | 2026-10-13 | 5.3 Medium |
| A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php of the component Browser Screenshot Service. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 is able to resolve this issue. Patch name: 393255e7302ae5503331d45802e2eee01c6a47fe. You should upgrade the affected component. | ||||
| CVE-2026-108756 | 2 Abilityai, Trinity Project | 2 Trinity, Trinity | 2026-10-13 | 5.4 Medium |
| Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send messages through the owner's bot token, replace the binding with their own token, or delete it. | ||||
| CVE-2026-108751 | 1 Modu-ai | 1 Moai-adk | 2026-10-13 | 4.4 Medium |
| MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so atomicWriteFile truncates and overwrites victim-writable files with MoAI template content. | ||||
| CVE-2026-108746 | 1 Vearch | 1 Vearch | 2026-10-13 | 8.8 High |
| Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege levels for resources listed in a role. Authenticated non-root users can upsert and delete documents with read-only access, or call PUT /roles to grant their role WriteRead privileges, escalating toward cluster administrator access. | ||||
| CVE-2026-108740 | 1 Arp242 | 1 Goatcounter | 2026-10-13 | 8.3 High |
| GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify protected account fields via form-encoded requests. Attackers with read-only access can POST user.access[all]=* and user.email_verified=true to /user/pref, bypassing readonly tags to gain superuser or admin access. | ||||
| CVE-2026-108735 | 1 Miniflux Project | 1 Miniflux | 2026-10-13 | 4.3 Medium |
| Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services. | ||||
| CVE-2026-108730 | 1 The-commit-company | 1 Raven | 2026-10-13 | 4.3 Medium |
| Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authenticated non-members can call get_messages_with_dates or get_all_files_shared_in_channel with predictable channel IDs to read Public channel history and Open/Public channel file metadata across workspaces. | ||||
| CVE-2026-108725 | 1 Cheshire-cat-ai | 1 Core | 2026-10-13 | 5.4 Medium |
| Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uploads plugin that allows authenticated users to upload HTML files via POST /uploads without type restrictions. Attackers can send the public GET /uploads/{path} URL to a signed-in victim, executing script in the application origin with the victim's access_token cookie, including administrators. | ||||
| CVE-2026-108720 | 1 Phpipam | 1 Phpipam | 2026-10-13 | 4.3 Medium |
| phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::check_permission. Attackers can open customer objects.php, single-location.php or nat_details.php to read IP addresses, CIDRs, hostnames and MAC addresses from sections they cannot access. | ||||
| CVE-2026-108715 | 1 Librenms | 1 Librenms | 2026-10-13 | 4.3 Medium |
| LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smokeping/auth.inc.php that checks the src probe device instead of the rendered target device. Restricted users permitted on a probe device can request smokeping_in or smokeping_out graphs with arbitrary device ids to view latency data and enumerate device names. | ||||
| CVE-2026-108710 | 1 Orneryd | 1 Nornicdb | 2026-10-13 | 6.5 Medium |
| NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied read can submit search queries or node IDs to retrieve node IDs, labels and full property maps. | ||||
| CVE-2026-108697 | 1 Coreshop | 1 Coreshop | 2026-10-13 | 4.3 Medium |
| CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403() check. Authenticated Pimcore users lacking resource permissions can request the generated list routes to enumerate payment providers, carriers, price rules, stores, and tax rules including ids, names, and identifiers. | ||||
| CVE-2026-108683 | 1 Zhayujie | 1 Cowagent | 2026-10-13 | 4.3 Medium |
| A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 is sufficient to resolve this issue. The name of the patch is b7967210268fc4c0afea1078223e74e7e96a8a54. You should upgrade the affected component. | ||||
| CVE-2026-108578 | 1 Neterbit | 2 Nw-431f, Nw-431f Router | 2026-10-13 | 5.3 Medium |
| A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-105052 | 1 Ibm | 1 Maximo Application Suite | 2026-10-13 | 7.5 High |
| IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. | ||||
| CVE-2024-58391 | 1 Frappe | 1 Frappe | 2026-10-13 | 4.3 Medium |
| Frappe before 14.58.0 and 15.x before 15.4.0 contains a cross-site scripting vulnerability in printview because printview parameters are not escaped before being rendered. Remote attackers can craft a malicious printview URL that, when visited by a victim, injects HTML and executes script in the victim's browser session. | ||||
| CVE-2023-54409 | 1 Frappe | 1 Frappe | 2026-10-13 | 4.8 Medium |
| Frappe before 13.46.1 and 14.x before 14.20.0 contains a cross-site scripting vulnerability because the html2text function weakly sanitizes user input. Authenticated attackers can supply crafted HTML that is insufficiently sanitized by html2text, executing scripts in the browsers of users who view the rendered content. | ||||
| CVE-2026-87679 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-13 | 7.2 High |
| When Brocade Fabric OS versions before 10.0.1 processes trunk configuration operations, the application parses user-supplied list strings into dynamically allocated heap arrays without enforcing boundary checks on the maximum allowable number of elements. An authenticated administrator can exploit this vulnerability via crafted REST API requests containing an excessive number of list delimiters, causing heap corruption that can result in service crash or arbitrary code execution. | ||||
| CVE-2026-87680 | 2 Broadcom, Brocade | 2 Fabric Operating System, Fabric Os | 2026-10-13 | 8.8 High |
| A command injection vulnerability in the REST API management interface of Brocade Fabric OS versions before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters. | ||||
| CVE-2026-107295 | 1 Pydantic | 2 Pydantic-ai, Pydantic Ai | 2026-10-13 | 7.6 High |
| Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.34.0 until 1.107.4 and 2.28.0, the Agent.to_web() and clai web development chat endpoint has missing request content-type validation. A website visited by a developer can submit a browser-compatible request to a loopback-hosted chat server, causing the served agent to run and execute tools with the privileges and credentials of the local process; client-relayed approval decisions also leave requires_approval=True tools exposed. Binding to localhost does not prevent a browser page from reaching the loopback address. This issue is fixed in versions 1.107.4 and 2.28.0. | ||||