Export limit exceeded: 395534 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 395534 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (395534 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-92752 | 1 Metasfresh | 1 Metasfresh | 2026-09-18 | 8.3 High |
| metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing record-level permissions. Attackers can enumerate sequential document identifiers to read, replace, and delete attachments and comments on records their role cannot access. | ||||
| CVE-2026-92759 | 1 Secobserve | 1 Secobserve | 2026-09-18 | 6.5 Medium |
| SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the basic_auth_password field from API configuration responses. View-only product members can retrieve the decrypted basic-auth password of configured scanner or integration service accounts through standard REST endpoints. | ||||
| CVE-2026-92761 | 1 Retspen | 1 Webvirtcloud | 2026-09-18 | 8.8 High |
| WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-only grants can power off virtual machines, reset root passwords, install SSH keys, and manage ISO images by exploiting the get_instance gate that only checks grant existence. | ||||
| CVE-2026-92762 | 1 Pelican | 1 Panel | 2026-09-18 | 8.8 High |
| Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks. Attackers with startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands, docker images, and variables to execute arbitrary commands in the container. | ||||
| CVE-2026-90161 | 1 Linux | 1 Linux Kernel | 2026-09-18 | 7.1 High |
| In the Linux kernel, the following vulnerability has been resolved: erofs: fix interlaced ztailpacking pclusters On-disk sizes of interlaced pclusters should be block-aligned, and ztailpacking interlaced pclusters should be invalid at all. Currently, mkfs.erofs won't generate any interlaced pcluster with ztailpacking enabled, so this doesn't affect any existing valid filesystems. However, crafted images can contain invalid interlaced ztailpacking pclusters, resulting in an out-of-bounds read from a kmap'd page and copying irrelevant kernel memory into userspace-visible page cache. | ||||
| CVE-2026-92778 | 1 Yahoo | 1 Cmak | 2026-09-18 | 5.4 Medium |
| CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the feature gate. Attackers can access the form endpoints to start and stop the recurring election scheduler, disrupting leadership across managed Kafka clusters. | ||||
| CVE-2026-92779 | 1 Builderio | 7 Sdk-angular, Sdk-qwik, Sdk-react and 4 more | 2026-09-18 | 7.6 High |
| Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing __proto__, prototype, or constructor paths to pollute Object.prototype during rendering, affecting all subsequent objects created in the process including other tenants' renders. | ||||
| CVE-2026-92780 | 2 Didi, Knowstreaming Project | 2 Knowstreaming, Knowstreaming | 2026-09-18 | 8.8 High |
| KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality. Attackers can call identity-management endpoints to create administrator accounts or grant themselves administrative privileges without proper authorization. | ||||
| CVE-2026-92781 | 1 Builderio | 7 Sdk-angular, Sdk-qwik, Sdk-react and 4 more | 2026-09-18 | 6.3 Medium |
| Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes builder.userAttributes query parameters without prototype guards. Attackers can craft preview links with __proto__ or prototype segments to pollute Object.prototype in a visitor's browser when the SDK processes the malicious URL. | ||||
| CVE-2026-92784 | 1 Refinedev | 1 @refinedev/inferencer | 2026-09-18 | 7.5 High |
| @refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers controlling the data provider can inject malicious JavaScript through crafted JSON property names that execute in the developer's browser when the Inferencer page renders. | ||||
| CVE-2026-92785 | 1 Angel-ml | 1 Angel | 2026-09-18 | 8.1 High |
| Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint. | ||||
| CVE-2026-92786 | 1 Lightgbm-org | 1 Lightgbm | 2026-09-18 | 7.8 High |
| LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation. | ||||
| CVE-2026-92790 | 1 Higress-group | 1 Higress | 2026-09-18 | 6.5 Medium |
| Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed thresholds intended to restrict costly model backend calls. | ||||
| CVE-2026-92796 | 1 Manticoresoftware | 1 Manticore Search | 2026-09-18 | 8.8 High |
| Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery. | ||||
| CVE-2026-92809 | 1 Prestashop | 2 Prestashop, Psgdpr | 2026-09-18 | 4.3 Medium |
| PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs. | ||||
| CVE-2026-92811 | 1 Browserless | 2 Browserless, Chrome | 2026-09-18 | 6.5 Medium |
| browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false. | ||||
| CVE-2026-92812 | 1 Decaporg | 1 Decap-server | 2026-09-18 | 6.8 Medium |
| decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outside the intended repository root. | ||||
| CVE-2026-89034 | 1 Tch | 1 Qring | 2026-09-18 | 6.5 Medium |
| TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low Energy access vulnerability that allows any nearby attacker to connect to the device without pairing, authentication, or user approval by exploiting the exposed Nordic UART Service which enforces no client authentication or command authorization. Attackers within Bluetooth Low Energy range can connect directly to the ring, bypassing the official application and cloud authentication, to read battery levels, activate live heart rate monitoring, and retrieve stored historical heart rate and blood oxygen records. | ||||
| CVE-2026-50604 | 1 Acer | 1 Agent Service | 2026-09-18 | N/A |
| A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be established, potentially allowing access to functionality that should be restricted. | ||||
| CVE-2026-87935 | 2 Ichurakov, Wordpress | 2 Paid Downloads, Wordpress | 2026-09-18 | 8.1 High |
| The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. On Apache servers where AllowOverride is enabled, an .htaccess file placed in the upload directory may block direct HTTP retrieval of uploaded files, limiting exploitability to stacks that do not honor .htaccess directives such as nginx, LiteSpeed, and Apache with AllowOverride None. | ||||