Export limit exceeded: 420515 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420515 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119704 | 1 Bastillebsd | 1 Bastille | 2026-11-05 | 6.8 Medium |
| Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. Attackers inside a jail can plant symlinks pointing to host paths or other jail roots, so administrator-run copies overwrite or read host files with root privileges. | ||||
| CVE-2026-119700 | 2 Wordpress-extensions, Wpgraphql | 2 Wpgraphql, Wpgraphql | 2026-11-05 | 5.3 Medium |
| WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments. | ||||
| CVE-2026-119664 | 1 Wannabespace | 1 Tamery | 2026-11-05 | 4.3 Medium |
| Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history. | ||||
| CVE-2026-119660 | 1 Yincongcyincong | 1 Musebot | 2026-11-05 | 9.8 Critical |
| MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots. | ||||
| CVE-2026-119656 | 1 Coreshop | 1 Coreshop | 2026-11-05 | 7.5 High |
| CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques. | ||||
| CVE-2026-119652 | 1 Hulaspark | 1 Hula-server | 2026-11-05 | 4.3 Medium |
| HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list. | ||||
| CVE-2026-119648 | 1 Tencent | 1 Blueking Cmdb | 2026-11-05 | 4.3 Medium |
| Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost. | ||||
| CVE-2026-119644 | 1 Wangyunf | 1 Blossom | 2026-11-05 | 5.4 Medium |
| Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status. | ||||
| CVE-2026-119601 | 1 Afflib Project | 1 Afflib | 2026-11-05 | 6.1 Medium |
| AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop to write past the buffer and crash forensic tools. | ||||
| CVE-2026-119597 | 1 Aidotnet | 1 Opendeepwiki | 2026-11-05 | 9.8 Critical |
| OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 bearer tokens with an Admin role claim to access /api/admin endpoints and control users, roles, repositories, settings, and API keys. | ||||
| CVE-2026-119576 | 1 Arcadedata | 1 Arcadedb | 2026-11-05 | 4.3 Medium |
| ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators. | ||||
| CVE-2026-119567 | 1 Vsftpd Project | 1 Vsftpd | 2026-11-05 | 3.1 Low |
| vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tokens, so attackers can send XRMD, XMKD, XCWD, XPWD, or XCUP to perform blocked operations like deleting directories. | ||||
| CVE-2026-119563 | 1 Phpmyadmin | 1 Phpmyadmin | 2026-11-05 | 5.4 Medium |
| phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose name contains HTML markup that executes in another user's session when they add a condition on it in Designer query mode. | ||||
| CVE-2026-119559 | 1 Litespeedtech | 1 Openlitespeed | 2026-11-05 | 5.9 Medium |
| OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() implementation that always returns true, attackers can present a non-mTLS host's SNI with a protected Host header to access protected content. | ||||
| CVE-2026-119555 | 1 Moodle | 1 Moodle | 2026-11-05 | 4.3 Medium |
| Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and enrolment checks, so non-editing teachers can iterate userid values to read other groups' grade feedback and users' names and identity fields such as email. | ||||
| CVE-2026-119547 | 1 Forgejo | 1 Forgejo | 2026-11-05 | 4.3 Medium |
| Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user token or session can enumerate sequential key IDs to obtain titles, fingerprints and public key material of other users' SSH, deploy and principal keys. | ||||
| CVE-2026-119428 | 1 Phpmyadmin | 1 Phpmyadmin | 2026-11-05 | 3.7 Low |
| phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker-chosen host and port values reaching Validator::testDBConnection() to open MySQL-protocol connections and probe internal ports using returned error messages. | ||||
| CVE-2026-119424 | 1 Opnsense | 2 Core, Opnsense | 2026-11-05 | 6.8 Medium |
| OPNsense core before 26.7.8 contains a configuration line injection vulnerability that allows authenticated users with wireless-edit privilege to inject directives by embedding CR/LF characters in WPA fields. Attackers can place newlines in wpa.identity, wpa.passphrase, or RADIUS shared secrets to append arbitrary wpa_supplicant or hostapd directives loaded by root-run daemons. | ||||
| CVE-2026-119420 | 1 Getlago | 1 Lago | 2026-11-05 | 8.8 High |
| Lago through 1.55.0 contains an authentication bypass vulnerability that allows organization administrators to obtain session tokens for existing accounts via the acceptInvite mutation without a password check. Attackers can invite a victim's email, accept with an arbitrary password, and receive a JWT to access the victim's organizations, billing data, API keys and payment integrations. | ||||
| CVE-2026-119416 | 1 Cakephp | 1 Cakephp | 2026-11-05 | 4.8 Medium |
| CakePHP through 5.4.3 contains an improper cookie domain validation vulnerability in the Http Client CookieCollection that allows malicious servers to receive and plant cookies by abusing unanchored suffix matching. Attackers controlling a host such as one ending in a victim domain suffix, or sending Set-Cookie Domain values for unrelated hosts, can steal session cookies or inject cookies into shared client cookie jars. | ||||