Export limit exceeded: 25370 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408203 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408203 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-95502 | 2026-10-13 | 5.3 Medium | ||
| A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compressed responses (uncontrolled resource consumption). Exploitation requires an administrator to have configured Git Sync with that server. | ||||
| CVE-2026-93294 | 2026-10-13 | 6.3 Medium | ||
| A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity. | ||||
| CVE-2026-92088 | 2026-10-13 | N/A | ||
| Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation. This issue affects upKeeper Instant Privilege Access: through 1.7.1. | ||||
| CVE-2026-93895 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-10-13 | 9.1 Critical |
| IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access controls configured on gRPC service methods. | ||||
| CVE-2026-95695 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-10-13 | 7.4 High |
| IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to bypass security restrictions due to incorrect authorization. | ||||
| CVE-2026-95696 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-10-13 | 6.5 Medium |
| IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow a remote attacker to cause a denial of service due to an uncaught exception. | ||||
| CVE-2026-69226 | 1 Esri | 1 Portal For Arcgis | 2026-10-13 | 6.5 Medium |
| A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation. | ||||
| CVE-2026-53562 | 2026-10-13 | N/A | ||
| Improper link resolution before file access ('link following') vulnerability in Citrix UniconOS. This issue affects UniconOS: before 2607 CR and before 2603 LTSR CU2. | ||||
| CVE-2026-33374 | 2026-10-13 | 6.5 Medium | ||
| The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded memory allocations that can crash the server through out-of-memory conditions. | ||||
| CVE-2026-15577 | 2026-10-13 | 6.5 Medium | ||
| A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled. | ||||
| CVE-2026-110235 | 2026-10-13 | 5.5 Medium | ||
| MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting files anywhere the app can write on shared storage. | ||||
| CVE-2026-110224 | 1 Webkul | 1 Qloapps | 2026-10-13 | 5.4 Medium |
| QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes rejected alias and search values unescaped in validation errors. Attackers can induce an authenticated back-office user to submit a crafted request, executing JavaScript in that user's administrative session. | ||||
| CVE-2026-110219 | 1 Webkul | 1 Qloapps | 2026-10-13 | 5.4 Medium |
| QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the price parameter of the back-office Additional Facilities form. Attackers can induce an authenticated back-office user to submit a crafted request whose unescaped price value is re-rendered after failing validation, executing JavaScript in the administrative session. | ||||
| CVE-2026-110214 | 2026-10-13 | 3.7 Low | ||
| Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/file/download endpoint by using the published FILE_DOWNLOAD_SIGN_SECRET constant. Attackers can compute HMAC-SHA256 signatures of guessed file ids offline to download stored files such as avatars, editor images and attachments. | ||||
| CVE-2026-110209 | 2026-10-13 | 6.5 Medium | ||
| Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers can query the api-config get/list and system config endpoints to obtain AI provider API keys, proxy passwords and mail_password, enabling billing abuse and sending mail as the platform. | ||||
| CVE-2026-10759 | 1 Esri | 1 Portal For Arcgis | 2026-10-13 | 5.5 Medium |
| A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations. | ||||
| CVE-2026-108980 | 1 Blinko | 1 Blinko | 2026-10-13 | 8.8 High |
| Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin. It builds the plugin install path from an unsanitized name in server/routerTrpc/plugin.ts, and the plugin.installPlugin tRPC procedure is open to any authenticated user. Thus, a name containing ../ sequences writes the downloaded plugin files outside the plugins directory. Because the official Docker image runs as root, an authenticated attacker overwrites a root-owned startup file and achieves remote code execution as root. Self-registration for an account may be possible. | ||||
| CVE-2026-108905 | 1 Ph7software | 1 Ph7builder | 2026-10-13 | 7.5 High |
| pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields. | ||||
| CVE-2026-108888 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-13 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minimal role can call /sys/sysDepartRole/exportXls to download all sys_depart_role records, including role names, codes, descriptions and creating users. | ||||
| CVE-2026-108883 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-13 | 6.5 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of DingTalk, WeCom or Feishu integrations to redirect directory synchronisation and messaging to attacker-controlled applications or break them. | ||||