Export limit exceeded: 93361 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (93361 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-71274 | 1 Openshwprojects | 1 Openbk7231t App | 2026-08-10 | 8.5 High |
| OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding. | ||||
| CVE-2026-71272 | 1 Usememos | 1 Memos | 2026-08-10 | 8.5 High |
| Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the original hostname rather than the already-validated IP address. | ||||
| CVE-2026-71271 | 1 Usememos | 1 Memos | 2026-08-10 | 8.5 High |
| Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/html_meta.go, which does. | ||||
| CVE-2026-71270 | 1 Stirling | 1 Stirling Pdf | 2026-08-10 | 8.6 High |
| Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf). | ||||
| CVE-2026-71269 | 1 Nodered | 1 Node-red | 2026-08-10 | 7.2 High |
| Node-RED's local-filesystem library storage module (getLibraryEntry and saveLibraryEntry in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST /library/:lib/:type/*path, joins the user-supplied path parameter directly into the filesystem path via fspath.join(libDir, type, path) with no traversal sanitization, containment check, or path normalization/prefix verification. | ||||
| CVE-2026-71266 | 1 Syoyo | 1 Tinyobjloader-c | 2026-08-10 | 7.8 High |
| tinyobjloader-c's tinyobj_parse_and_index_mtl_file (tinyobj_loader_c.h) reads each line of a .mtl material file into a fixed 4096-byte stack buffer via memcpy(linebuf, p, p_len), guarded only by . The identical vulnerable pattern is duplicated in a second function in the same file. | ||||
| CVE-2026-71265 | 1 Domoticz | 1 Domoticz | 2026-08-10 | 7.5 High |
| Domoticz's MochadTCP::MatchLine handler for MOCHAD_RFSEC messages (hardware/MochadTCP.cpp) copies network-received data from the up-to-1028-byte m_mochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches (DS10A/KR10A/MS10A device types). | ||||
| CVE-2026-71264 | 1 Aircoookie | 1 Wled | 2026-08-10 | 8.2 High |
| WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network. | ||||
| CVE-2026-71261 | 1 Mackron | 1 Dr Libs | 2026-08-10 | 7.8 High |
| dr_libs dr_wav.h (all versions through current master) contains an integer overflow in W64 CUE chunk metadata parsing. In drwav__metadata_process_chunk, a stage-1 capacity estimate truncates the 64-bit W64 chunk sizeInBytes to size_t before dividing by DRWAV_CUE_POINT_BYTES; on 32-bit builds this truncation causes the pre-allocated extra metadata capacity to be computed incorrectly. | ||||
| CVE-2026-71259 | 1 Esphome | 1 Esphome | 2026-08-10 | 8.6 High |
| ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively). | ||||
| CVE-2026-71255 | 1 Debevv | 1 Nanomodbus | 2026-08-10 | 8.6 High |
| nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter. | ||||
| CVE-2026-71252 | 1 Raghav993 | 1 Toner-management | 2026-08-10 | 8.2 High |
| toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories) executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforced only in listing views. | ||||
| CVE-2026-71243 | 1 Adaltas | 1 Backmeup | 2026-08-10 | 8.8 High |
| The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " + path.join(info.destination, info.name) + "; " - and executes the resulting string through a shell via ssh2-exec (locally via child_process, or remotely via SSH when an ssh handle is supplied), rather than using execFile/spawn with an argument array. | ||||
| CVE-2026-71242 | 1 Crater-invoice-inc | 1 Crater | 2026-08-10 | 8.2 High |
| Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID. | ||||
| CVE-2026-71241 | 1 Lyric777 | 1 Book-management-system | 2026-08-10 | 7.5 High |
| Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because card_id values are sequential integers, the entire student database can be enumerated without authentication. | ||||
| CVE-2026-71239 | 1 Djangocrm | 1 Django-crm | 2026-08-10 | 8.1 High |
| DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template call; email_creators.py passes eml_message.subject directly as a template string to Template; and helpers.py contains the same f-string interpolation pattern. | ||||
| CVE-2026-71236 | 1 Grocy | 1 Grocy | 2026-08-10 | 8.7 High |
| Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &lt;, &gt;, and &amp; back to <, >, and & immediately after purification. | ||||
| CVE-2026-71235 | 1 Absmach | 1 Magistrala | 2026-08-10 | 8.8 High |
| Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal). | ||||
| CVE-2026-71234 | 1 Documize | 1 Community | 2026-08-10 | 7.5 High |
| Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value. | ||||
| CVE-2026-71233 | 1 Invoiceninja | 1 Invoice Ninja | 2026-08-10 | 8.7 High |
| InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization. | ||||