Export limit exceeded: 410237 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410237 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-111626 | 1 Webreaper | 1 Damselfly | 2026-10-19 | 9.8 Critical |
| Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control. | ||||
| CVE-2026-111661 | 1 Wayn111 | 1 Waynboot-mall | 2026-10-19 | 5.3 Medium |
| waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion. | ||||
| CVE-2026-111664 | 1 Safing | 1 Portmaster | 2026-10-19 | 4.4 Medium |
| Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses version checks and auto-apply settings, installing older Safing-signed releases carrying previously fixed vulnerabilities. | ||||
| CVE-2026-111668 | 1 Beizhu-1209 | 1 Aihelms | 2026-10-19 | 5.4 Medium |
| AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports. | ||||
| CVE-2026-111669 | 1 Izhaorui | 1 Zr.admin.net | 2026-10-19 | 6.5 Medium |
| ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques. | ||||
| CVE-2026-111674 | 1 Hello-hao | 1 Tbed | 2026-10-19 | 4.3 Medium |
| Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names with attacker-chosen text attributed to the victim. | ||||
| CVE-2026-111676 | 2 Faveosuite, Ladybirdweb | 2 Faveo-helpdesk, Faveo Helpdesk | 2026-10-19 | 4.3 Medium |
| Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes. | ||||
| CVE-2026-111677 | 1 Adri Van Os | 1 Antiword | 2026-10-19 | 5.5 Medium |
| Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap allocation that crash the process. | ||||
| CVE-2026-69999 | 1 Microsoft | 11 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 8 more | 2026-10-19 | 5.5 Medium |
| Out-of-bounds read in Windows Update allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-111678 | 1 Adri Van Os | 1 Antiword | 2026-10-19 | 3.3 Low |
| Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiword or corrupting style parsing. | ||||
| CVE-2026-111679 | 1 Ekkolearnai | 1 Ekko-studio | 2026-10-19 | 5.4 Medium |
| Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and clear server-wide login lockouts via /api/auth/locked-ips. Attackers can send DELETE requests without an ip parameter to invoke unlockAll(), disabling the login rate limiter during password guessing against super_admin accounts. | ||||
| CVE-2026-111681 | 1 Smartloli | 1 Efak | 2026-10-19 | 8.8 High |
| EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because the /api/users endpoints lack administrator role checks. Attackers can send POST, PUT, or DELETE requests to UserController to grant themselves ROLE_ADMIN, create administrators, or delete users, gaining control of managed Kafka clusters. | ||||
| CVE-2026-111682 | 1 Smartloli | 1 Efak | 2026-10-19 | 6.5 Medium |
| EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to read LLM provider API keys through the /api/model-config REST API. Attackers with any ROLE_USER account can query /api/model-config/page or /api/model-config/{id} to retrieve unmasked keys, enabling provider account access and incurred costs. | ||||
| CVE-2026-111691 | 1 Wimoor-erp | 1 Wimoor | 2026-10-19 | 7.4 High |
| WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations. | ||||
| CVE-2026-111692 | 1 Databufflabs | 1 Databuff | 2026-10-19 | 9.8 Critical |
| DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API. | ||||
| CVE-2026-111721 | 1 Jingsewu | 1 Open-wes | 2026-10-19 | 5.4 Medium |
| Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu permission can enumerate sequential IDs on freezeContainerStock and unfreezeContainerStock endpoints to freeze or unfreeze container stock in other warehouses. | ||||
| CVE-2026-111722 | 1 Lingguoai | 1 Lingguo-drama | 2026-10-19 | 8.1 High |
| LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects. | ||||
| CVE-2026-111723 | 1 Lingguoai | 1 Lingguo-drama | 2026-10-19 | 8.8 High |
| LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password via PUT, raise their authority_id, and delete accounts. | ||||
| CVE-2026-111793 | 1 Openwave Messaging | 1 Webtop Media Transcoder | 2026-10-19 | 4.3 Medium |
| Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing the Webmail experience. | ||||
| CVE-2026-102834 | 1 Bytedeco | 1 Javacv | 2026-10-19 | 7.5 High |
| JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint or a tampered plaintext stream. The source can return an oversized Content-Length header in an MJPEG stream. Successful exploitation can trap the frame-grabbing thread in a permanent CPU-spinning loop and deny service. This issue is fixed in version 1.5.14. | ||||