Export limit exceeded: 413979 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 15865 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15865 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59963 | 1 Tandoorrecipes | 1 Recipes | 2026-10-17 | 7.1 High |
| Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10. | ||||
| CVE-2026-61726 | 1 Tandoorrecipes | 1 Recipes | 2026-10-17 | 8.1 High |
| Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12. | ||||
| CVE-2026-66874 | 1 Gitea | 1 Gitea | 2026-10-17 | 6.5 Medium |
| For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from running. Because skipped statuses count as success, branch protection or organization-required workflow checks can appear satisfied without the mandated workflow executing; no runner or maintainer approval is required for this path. | ||||
| CVE-2026-68908 | 1 Mz-automation | 1 Libiec61850 | 2026-10-17 | 5.3 Medium |
| libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to serialize the report, the function wraps rptIdBuf[130] as a temporary MmsValue and passes it to MmsValue_setVisibleString. The setter's resize path frees the stack-backed buffer, allowing a remote client to trigger an invalid free and server crash by writing the oversized RptID and then generating a report. This issue is fixed in version 1.6.2. | ||||
| CVE-2026-68907 | 1 Mz-automation | 1 Libiec61850 | 2026-10-17 | N/A |
| libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. The helper treats uninitialized dataSetRef[130] storage as a source string, causing strlen to read beyond the stack buffer, and then copies those bytes into the caller-owned listName buffer. A remote defineNamedVariableList request can crash servers that have dynamic dataset service enabled and a dataset access handler installed; the advisory also observes caller stack corruption but establishes denial of service as the primary impact. This issue is fixed in version 1.6.2. | ||||
| CVE-2024-58398 | 1 Coder | 1 Coder | 2026-10-17 | 4.3 Medium |
| Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing. | ||||
| CVE-2026-58395 | 1 Opnsense | 1 Core | 2026-10-17 | 4.3 Medium |
| OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11. | ||||
| CVE-2026-63159 | 1 Omnispace | 1 Agora Project | 2026-10-17 | 7.4 High |
| Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts. | ||||
| CVE-2026-63153 | 1 Omnispace | 1 Agora Project | 2026-10-17 | 8.1 High |
| Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right records for a caller-supplied target space without verifying the caller has rights to that space. Attackers can assign access affectations to spaces outside their own reach, breaking tenant isolation and granting unauthorized access to restricted spaces. | ||||
| CVE-2026-61838 | 1 Lycheeorg | 1 Lychee | 2026-10-17 | N/A |
| Lychee is a free, open-source photo-management tool. Prior to 7.6.3, GET /api/v2/Zip authorizes album and photo archives through AlbumPolicy::canDownload() and PhotoPolicy::canDownload() without first enforcing AlbumPolicy::canAccess(). For a public, password-protected album with grants_download enabled, an unauthenticated attacker who knows the shared album identifier can download a ZIP archive without supplying the password or unlocking the album, even though browsing endpoints deny access. The archive exposes the album's photos and can include full-resolution originals and associated metadata when grants_full_photo_access is enabled. This issue is fixed in version 7.6.3. | ||||
| CVE-2026-54683 | 1 Nl-portal | 1 Nl-portal-backend-libraries | 2026-10-17 | 6.5 Medium |
| NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET /api/documentapi/{documentapi}/document/{documentId}/content REST route allow any authenticated portal user to retrieve a document without checking ownership of or another authorized relationship to it. A user with a valid login and another person's document identifier can read that document's contents, which may include sensitive personal information. Document identifiers are random and difficult to guess, but they can leak through other channels. This issue is fixed in version 3.0.3. | ||||
| CVE-2026-55387 | 1 Invoiceshelf | 1 Invoiceshelf | 2026-10-17 | N/A |
| InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. In version 2.3.3 and earlier, InvoiceShelf bulk-delete request validation accepts record identifiers without consistently binding them to the authenticated user's company_id. The affected DeleteCustomersRequest, DeleteEstimatesRequest, DeleteExpensesRequest, DeleteInvoiceRequest, DeleteItemsRequest, DeletePaymentsRequest, and DeleteUserRequest validators check that identifiers exist but do not consistently check tenant ownership. An authenticated user can submit another company's identifier and delete cross-company records. This vulnerability is fixed in 2.4.0. | ||||
| CVE-2026-55381 | 1 Invoiceshelf | 1 Invoiceshelf | 2026-10-17 | 7.1 High |
| InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, POST /api/v1/estimates/{estimate}/convert-to-invoice in ConvertEstimateController authorizes only the caller's create-invoice ability and does not authorize access to the route-bound Estimate. Because route-model binding can resolve an estimate from any company, an authenticated user with create-invoice ability can copy another company's line items, prices, totals, taxes, notes, currency, and customer data into an invoice in the attacker's company. The victim company's configured conversion action reaches checkForEstimateConvertAction and can also change or delete the original estimate. This issue is fixed in version 2.4.0. | ||||
| CVE-2026-55382 | 1 Invoiceshelf | 1 Invoiceshelf | 2026-10-17 | 7.6 High |
| InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.0, InvoiceShelf NotesController::show, NotesController::update, and NotesController::destroy authorize only the generic view notes or manage notes ability and do not pass the route-bound Note to NotePolicy::viewNotes or NotePolicy::manageNotes, so neither method checks the target note's company_id. Because the Note model has no global company scope, an authenticated staff user with ordinary note abilities can select another company's sequential note identifier and read, modify, or delete its reusable invoice, estimate, and payment note templates. This issue is fixed in version 2.4.0. | ||||
| CVE-2026-41541 | 1 Qnap Systems | 1 Qsync Central | 2026-10-17 | N/A |
| An unix symbolic link (symlink) following vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later | ||||
| CVE-2026-46708 | 1 Espocrm | 1 Espocrm | 2026-10-17 | 4.3 Medium |
| EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user cannot read or edit. The service validates access to the target list but retrieves the target record without the required record authorization, allowing unauthorized changes to its opted_out relationship state. This issue is fixed in version 9.3.7. | ||||
| CVE-2026-15468 | 1 Hypr | 1 Passwordless | 2026-10-17 | N/A |
| Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation. This issue affects HYPR Passwordless: before 11.3.3. | ||||
| CVE-2026-111607 | 1 Jeequan | 1 Jeepay | 2026-10-17 | 7.1 High |
| Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing. | ||||
| CVE-2026-111621 | 1 Tduckcloud | 1 Tduck-survey-form | 2026-10-17 | 4.3 Medium |
| TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds. | ||||
| CVE-2026-111351 | 1 Metasfresh | 1 Metasfresh | 2026-10-17 | 4.2 Medium |
| metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments. | ||||