Export limit exceeded: 15853 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15853 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112035 | 1 Aircheng-org | 1 Iwebshop-5 | 2026-10-19 | 6.3 Medium |
| A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.16. This affects the function send_message_mobile of the file controllers/simple.php. Such manipulation of the argument user_id leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-112002 | 1 Projectsend | 1 Projectsend | 2026-10-19 | 6.8 Medium |
| ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account. | ||||
| CVE-2026-111923 | 1 Fleetdm | 1 Fleet | 2026-10-19 | 7.5 High |
| Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that allows unauthenticated attackers to crash the server. Attackers can send a crafted binary plist payload of about 150 bytes to the enrollment endpoints, triggering exponential allocation or infinite recursion that exhausts CPU and memory. | ||||
| CVE-2026-111912 | 1 Admidio | 1 Admidio | 2026-10-19 | 6.5 Medium |
| Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authenticated members to modify other users' forum topics. Attackers can replace the topic_uuid parameter in their own topic_save request, reusing their CSRF token, to overwrite the victim topic's title and first post. | ||||
| CVE-2026-91858 | 1 Apache | 2 Apache Camel, Camel | 2026-10-19 | 6.5 Medium |
| FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance() and enabling only FEATURE_SECURE_PROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone already empties the accessExternalDTD and accessExternalStylesheet limits, so an external DTD or entity is refused. When a third-party JAXP TransformerFactory such as Saxon-HE is on the classpath, for example because the application also uses camel-xslt-saxon or camel-saxon, TransformerFactory.newInstance() returns that implementation instead, and FEATURE_SECURE_PROCESSING on its own does not restrict external resource access on it. A DOCTYPE with an external subset, or an external general entity, declared in the XSL-FO document is then resolved and expanded while the body is transformed. An external sender whose XSL-FO reaches a fop producer could therefore read files readable by the Camel process and cause the process to issue requests to hosts the document names. camel-fop does not bring such a factory itself, and excludes Xalan, so a default deployment using the JDK transformer is not affected; the issue is reachable only where another component has placed an alternative JAXP TransformerFactory on the classpath. Releases on the 4.14.x line and earlier reached end of life before this issue was resolved and do not receive a fix. | ||||
| CVE-2026-94229 | 1 Wordpress-extensions | 1 Truebooker | 2026-10-19 | 5.3 Medium |
| The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as invalidate the customer's own confirmation link. | ||||
| CVE-2026-79624 | 2 Apache, Apache Software Foundation | 2 Answer, Apache Answer | 2026-10-19 | N/A |
| Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3, which fixes the issue. | ||||
| CVE-2026-111793 | 1 Openwave Messaging | 1 Webtop Media Transcoder | 2026-10-19 | 4.3 Medium |
| Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. | ||||
| CVE-2026-109737 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-10-19 | 8.1 High |
| Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-109766 | 1 Mozilla | 1 Firefox | 2026-10-19 | 8.1 High |
| Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5. | ||||
| CVE-2026-89098 | 2 Nfs, Redhat | 4 Nfs-utils, Enterprise Linux, Openshift and 1 more | 2026-10-19 | 5.5 Medium |
| A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted. | ||||
| CVE-2026-111917 | 1 Vikunja | 1 Vikunja | 2026-10-19 | 6.5 Medium |
| Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revocation because handleAuth never checks the JWT sid claim against the sessions table. Attackers holding a stolen access token can open or maintain connections to /api/v2/ws after session deletion or TOTP enrollment, continuing to receive the victim's notification.created pushes, including comment, task and project content. | ||||
| CVE-2026-111715 | 2026-10-19 | 4.3 Medium | ||
| Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other departments' wiki metadata by supplying a foreign slug. Attackers with only wiki:read:own_dept permission can query get_neighborhood() without scope checks to obtain page slugs, titles, types and link edges up to depth 3. | ||||
| CVE-2026-107674 | 1 Ibm | 1 I | 2026-10-19 | 5.1 Medium |
| IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service from starting or cause it to fallback to non-secure connections. | ||||
| CVE-2025-71435 | 1 Coder | 1 Coder | 2026-10-19 | 4.2 Medium |
| Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token expiry when no refresh token is issued. Users can keep their APIKey cookie active through regular use, extending it every 24 hours to access Coder indefinitely after losing OIDC authorization. | ||||
| CVE-2026-109746 | 1 Mozilla | 1 Firefox | 2026-10-19 | 7.3 High |
| Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | ||||
| CVE-2026-111695 | 2026-10-19 | 7.1 High | ||
| Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows authenticated workspace members to access other workspaces' datasources by numeric id. Attackers can send foreign sequential ids to /datasource/detail, /listSchemaTable, /tableDetail, /update or /delete to obtain JDBC credentials, enumerate database schemas, and modify or delete datasources. | ||||
| CVE-2026-111680 | 1 Apiparklab | 1 Apipark | 2026-10-19 | 8.3 High |
| APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' services and applications by supplying their own team id in the team query parameter. Attackers can target service or app ids exposed by /api/v1/simple/services and /api/v1/simple/apps to read, modify, or delete other teams' services and applications via /api/v1/service/info and /api/v1/app endpoints. | ||||
| CVE-2026-111655 | 2026-10-19 | 3.8 Low | ||
| ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl, hash, or uuid to view download URLs, tamper records, or reassign ownership. | ||||
| CVE-2026-111645 | 1 Mrdoc | 1 Mrdoc | 2026-10-19 | 5.4 Medium |
| MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to modify other users' documents and projects. Attackers can send PUT requests with arbitrary sort_data document ids to publish private drafts and reparent documents, or POST with arbitrary top_doc ids to inject documents. | ||||