Export limit exceeded: 16430 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16430 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-115998 | 1 Cervantessec | 1 Cervantes | 2026-11-02 | 4.3 Medium |
| IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings, proof-of-concept details, credentials, and client information from projects they do not belong to. Additionally, they can modify finding statuses and transfer findings to their own projects, compromising data confidentiality and integrity. | ||||
| CVE-2026-115994 | 1 Cervantessec | 1 Cervantes | 2026-11-02 | 5.4 Medium |
| BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete targets belonging to other projects without authorization, compromising the integrity of penetration testing scopes, results, and associated security reports. | ||||
| CVE-2026-77026 | 1 Tassos.gr | 1 Convert Forms Component For Joomia | 2026-11-02 | N/A |
| Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms extension 1.0.0-4.4.16, 5.0.0-5.2.5 - CAPTCHA and field validation bypass. | ||||
| CVE-2026-115519 | 1 Knime | 1 Business Hub | 2026-11-02 | N/A |
| Missing security attributes on sensitive cookies in KNIME Business Hub before version 1.19.0 allow an unauthenticated remote attacker to compromise user sessions if other security issues such as a cross-site scripting vulnerability or a man-in-the-middle attack are present. A workaround is not possible. | ||||
| CVE-2026-115517 | 1 Knime | 1 Business Hub | 2026-11-02 | N/A |
| Unrestricted network access between execution contexts in KNIME Business Hub before version 1.19.0 allows an authenticated remote user to access open network ports on executors in different execution contexts. This only poses a security issue if the IP address of the attacked executor is know and there are open network ports that provided access without further authentication. By default no network ports are open. However, depending on the running workflows, ports may be opened and provide an attack surface. As a workaround, network policies can be created manually. | ||||
| CVE-2026-115416 | 1 Aws | 1 Amazon Athena | 2026-11-02 | 7.7 High |
| Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated user to read AWS account identifiers and SQL statement text query metadata from other AWS accounts. Query results, and data stored in Amazon S3 or other data sources, were not accessible through this issue. AWS remediated the issue on October 7, 2026. No customer action is required. | ||||
| CVE-2026-99158 | 1 Linux | 2 Linux, Linux Kernel | 2026-11-02 | 4.1 Medium |
| In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Fix false warning in ring_buffer_map_get_reader() The mmap reader can warn when it catches up with a writer that is still committing events. rb_get_reader_page() returns NULL in this case, but ring_buffer_map_get_reader() treats that result as an error. The initial rb_per_cpu_empty() check filters out an empty buffer, but it does not guarantee that the next reader page has committed data. Writers do not take reader_lock and can advance commit_page before publishing the committed length on the new page. rb_get_reader_page() can swap to that page, catch up with the writer and return NULL. Handle NULL through the existing no-data exit without warning. Remove the caller's reader_page == commit_page check as well, since the reader-page helper already handles that case. The existing metadata update and return path remain in place. | ||||
| CVE-2026-120420 | 2026-11-02 | 5.3 Medium | ||
| A denial-of-service vulnerability was found in the Drools DRL expression parser (org.drools:drools-drl-parser). The ANTLR4-generated DRL expression grammar parses parenthesised sub-expressions through mutually recursive descent rules with no limit on nesting depth. When a deeply nested parenthesised constraint expression (approximately 300-400 levels) is parsed, the parsing thread exhausts its stack and a java.lang.StackOverflowError is raised and propagates out of the parse call instead of being converted into a DroolsParserException. An actor able to supply a crafted DRL expression to an application that parses untrusted DRL can cause a denial of service. | ||||
| CVE-2026-86948 | 1 Apple | 1 Xcode | 2026-11-01 | 7.8 High |
| This issue was addressed by enforcing library validation on the affected binaries. This issue is fixed in Xcode 27. An app may be able to break out of its sandbox. | ||||
| CVE-2026-116605 | 1 Sourcecodester | 1 Online Food Ordering System | 2026-10-31 | 5.3 Medium |
| A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file order.php. The manipulation of the argument price/title results in client-side enforcement of server-side security. It is possible to launch the attack remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-116340 | 1 Iflytek | 1 Astron-agent | 2026-10-31 | 4.3 Medium |
| A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of the argument space-id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-61847 | 1 Rgrove | 1 Crass | 2026-10-31 | 7.5 High |
| Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the `:preserve_comments` option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a very large number of adjacent comments can cause excessive recursion and trigger a `SystemStackError`, denying service to the parsing application. Preserving comments avoids this recursive path. This issue is fixed in version 1.0.7. | ||||
| CVE-2026-119339 | 2026-10-30 | 5.5 Medium | ||
| Tesseract is an open source OCR engine. Prior to 5.5.4, WeightMatrix::DeSerialize trusts a mode byte from a traineddata LSTM network and calls WeightMatrix::DeSerializeOld when kDoubleFlag is clear. In default FAST_FLOAT builds, DeSerializeOld invokes ASSERT_HOST instead of returning an error, so loading a crafted model through TessBaseAPI::Init terminates the process and causes denial of service. This issue is fixed in version 5.5.4. | ||||
| CVE-2026-118668 | 1 Langchain-ai | 1 Langgraph-api | 2026-10-30 | 8.1 High |
| langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operation. An authenticated user can therefore access another user's Store namespace when a deployment relies on namespace rewriting for isolation, allowing unauthorized reads, overwrites, searches, or deletions. Python custom authentication and handlers that reject unauthorized namespaces instead of rewriting them are not affected. This issue is fixed in version 0.15.0. | ||||
| CVE-2026-82411 | 1 Maykinmedia | 1 Open-object | 2026-10-30 | 6.5 Medium |
| Open Object provides an API and admin interface to manage objects and object types. From 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint `GET /api/v2/objects/{uuid}/{index}`. The `history_detail` action in `src/objects/api/v2/views.py` calls `self.get_queryset()` and `get_object_or_404` directly instead of `self.get_object()`, so `check_object_permissions` and the per-object check in `ObjectTypeBasedPermission.has_object_permission` are not invoked. The queryset's `filter_for_token` applies only to the list and search actions, while `ObjectTypeBasedPermission.has_permission` allows non-create actions, leaving neither check to constrain history-detail records to the token's permitted ObjectType. The normal retrieve endpoint returns 403 for the same unauthorized object, and the sibling history action enforces the grant. Any valid non-superuser API token with a read grant on at least one ObjectType can therefore disclose another ObjectType's complete versioned object `data`, which can include citizen or case records and sensitive identifiers in government deployments. This issue is fixed in versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1. | ||||
| CVE-2026-110030 | 1 Wordpress-extensions | 1 Hide Price Until Login | 2026-10-30 | 5.3 Medium |
| The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled. | ||||
| CVE-2026-115259 | 1 Wordpress-extensions | 1 Photo Engine | 2026-10-30 | 4.9 Medium |
| The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks when updating post data through one of its REST API routes in all versions up to, and including, 6.5.8. This makes it possible for authenticated attackers, with Author-level access and above, to modify the title, content, excerpt and other fields of arbitrary posts, pages and attachments, including those belonging to other users. | ||||
| CVE-2026-111417 | 1 Foxitsoftware | 1 Foxit.com | 2026-10-30 | 7.5 High |
| A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users. | ||||
| CVE-2026-119049 | 1 Idinging | 1 Freemail | 2026-10-30 | 7.6 High |
| FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbox via the POST /api/create endpoint. Attackers who know a victim's address can become co-owners through assignMailboxToUser to read messages and verification codes, set forwarding, and delete mail. | ||||
| CVE-2026-119325 | 2 Bricks, Wordpress-extensions | 2 Bricks Theme, Bricks Theme | 2026-10-30 | 7.5 High |
| Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST endpoint that allows anonymous attackers to read draft and unpublished page content by supplying a popupId parameter without any status or capability checks. Attackers can obtain a public nonce via the bricks_regenerate_query_nonce action and then increment the popupId value in requests to the /wp-json/bricks/v1/load_popup_content endpoint to enumerate and disclose confidential content from any unpublished post on the site. | ||||