Export limit exceeded: 15491 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15491 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109343 | 1 Surrealdb | 1 Surrealdb | 2026-10-13 | 8.1 High |
| SurrealDB before 3.3.0 allows cross-tenant access because the SurrealQL USE statement switches a session to any namespace/database without checking that the caller's authenticated level covers it. Authenticated namespace, database, or record users can switch to another tenant and read, create, update, or delete rows in tables whose PERMISSIONS allow it, such as PERMISSIONS FULL. | ||||
| CVE-2026-109334 | 1 Surrealdb | 1 Surrealdb | 2026-10-13 | 8.1 High |
| SurrealDB before 3.3.0 does not check the caller-selected namespace or database against the level at which a namespace- or database-level system user authenticated, allowing cross-tenant access. An authenticated attacker can set the Surreal-NS/Surreal-DB headers on /sql or call the RPC use method to read, create, modify, and delete rows and read DEFINE PARAM values in another tenant where table PERMISSIONS allow it. | ||||
| CVE-2026-109329 | 1 Admidio | 1 Admidio | 2026-10-13 | 6.5 Medium |
| Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 contains a broken access control vulnerability that allows role administrators to assign users to roles in other organizations. Attackers can submit crafted assign requests to members_assignment.php with a foreign role UUID to gain privileged membership, log into that organization, and edit its user profiles. | ||||
| CVE-2026-109289 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-10-13 | 6.3 Medium |
| Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing terminal commands through an already open terminal WebSocket. Because the terminal proxy route in terminals.py checks access only on the first message, deactivated users can keep running commands and reading or writing files on the terminal server. | ||||
| CVE-2026-109264 | 1 Imagemagick | 1 Imagemagick | 2026-10-13 | 3.7 Low |
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service. | ||||
| CVE-2026-108862 | 1 Apiparklab | 1 Apipark | 2026-10-13 | 5.3 Medium |
| APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applications' credentials by supplying a foreign authorization UUID. Attackers with authorization-view permission on one application can query /api/v1/app/authorization or its details route to retrieve plaintext API keys regardless of HideCredential. | ||||
| CVE-2026-108752 | 2 Jupyter, Jupyterhub | 2 Jupyterhub, Jupyterhub | 2026-10-13 | 4.2 Medium |
| JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server. | ||||
| CVE-2026-108747 | 1 Lightdash | 1 Lightdash | 2026-10-13 | 4.2 Medium |
| Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other users' personal access tokens by supplying their UUID. Attackers can send DELETE requests to the personal-access-tokens route with a victim's token UUID, even across organizations, to revoke it and break API integrations. | ||||
| CVE-2026-107810 | 1 0xjacky | 1 Nginx-ui | 2026-10-13 | 8.1 High |
| Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx configuration path. An authenticated user who can create and restore backups can craft a valid backup that places a symlink in the staging tree and then writes a regular file through that link, even when both restore flags are false. This can persistently inject configuration or cause denial of service when the modified files are later consumed. This issue is fixed in version 2.5.0. | ||||
| CVE-2026-110127 | 2026-10-13 | 4.3 Medium | ||
| waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items. | ||||
| CVE-2026-110122 | 1 Pickmall | 1 Lilishop | 2026-10-13 | 4.3 Medium |
| PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods and SKUs by id without store-scoped checks, letting sellers bind their own templates to competitors' products and alter shipping charges. | ||||
| CVE-2026-94603 | 1 Podman Project | 1 Podman | 2026-10-13 | 10 Critical |
| Podman is a tool for managing OCI containers and pods. From 4.4.0 until 5.8.8 and 6.1.3, podman run treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL, allowing image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3. | ||||
| CVE-2026-102981 | 1 Makeplane | 1 Plane | 2026-10-13 | 6.5 Medium |
| Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/workspaces/{slug}/invitations/{pk}/join/ through WorkspaceJoinEndpoint, whose WorkSpaceMemberInviteSerializer exposes the secret invitation token directly and through get_invite_link. An external attacker can retrieve a token intended for another user and submit it to the invitation acceptance flow, joining the workspace without receiving the invitation and gaining the role assigned to the invite. This issue is fixed in version 1.4.0. | ||||
| CVE-2026-78022 | 1 Dell | 2 Policy Manager For Secure Connect Gateway, Secure Connect Gateway Policy Manager | 2026-10-13 | 6.8 Medium |
| Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Not Failing Securely ('Failing Open') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. | ||||
| CVE-2026-84321 | 1 0xjacky | 1 Nginx-ui | 2026-10-13 | 5.4 Medium |
| Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain in the short_token cache and authenticate again if the associated account is re-enabled before the cache entry expires because GetTokenUserByShortToken reads the surviving entry, restoring access to HTTP or WebSocket routes that accept short-token authentication. This issue is fixed in version 2.4.1. | ||||
| CVE-2026-77366 | 1 The-40-thieves | 1 Obsidian-tc | 2026-10-13 | 9.9 Critical |
| obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim, and the folder access-control list is shared globally. Any valid token can therefore select another configured vault and read, write, or delete its contents through affected tools. Version 1.3.1 fixes the vulnerability by binding tokens and request context to a vault and rejecting mismatched input.vault values before scope checks. | ||||
| CVE-2026-109194 | 1 Redhat | 1 Quay | 2026-10-13 | 6.4 Medium |
| A flaw was found in Red Hat Quay. The build trigger management application programming interface (API) fails to verify whether a requested trigger belongs to the specified repository. An authenticated user with administrative access to any repository can view, modify, or permanently delete build triggers and associated write tokens of another repository if they know the victim trigger's universally unique identifier (UUID). | ||||
| CVE-2026-109166 | 2 Dromara, Tangyh | 2 Lamp-cloud, Lamp-cloud | 2026-10-13 | 6.5 Medium |
| lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to obtain storage URLs for other users' files by supplying arbitrary file ids. Attackers can send another user's file ids to the findUrlById handler of FileAnyoneController, which never checks ownership, to retrieve access URLs and read uploaded attachments. | ||||
| CVE-2026-104774 | 1 Coraza | 1 Coraza | 2026-10-13 | 5.8 Medium |
| OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/js_decode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is triggered when a rule relies on t:jsDecode and the request contains JavaScript octal escape sequences. An unauthenticated attacker can encode attack syntax with JavaScript octal escapes so the backend decodes the intended bytes while Coraza rules using t:jsDecode inspect corrupted null-byte output. The mismatch can bypass WAF rules and expose the protected application to attacks such as cross-site scripting or SQL injection. This issue is fixed in version 3.8.0. | ||||
| CVE-2026-102663 | 1 Openlistteam | 1 Openlist | 2026-10-13 | 4.3 Medium |
| OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath. When Bleve search is enabled and a restricted authenticated user searches the global index for content in a sibling path, the user causes a globally indexed sibling-path result to pass the prefix check. The strings.HasPrefix(node.Parent, user.BasePath) predicate allows a sibling path such as /base2 to be treated as contained by /base. Unauthorized file metadata or file-existence information can be disclosed, and the backend Total value can reveal a match even when another access check removes the individual result. This issue is fixed in version 4.2.4. | ||||