Export limit exceeded: 425329 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425335 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-54423 | 2026-11-13 | 7.5 High | ||
| OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG editor fails to filter scripts in specially crafted HTML tags. Attackers can inject an img element with a malicious onmouseover attribute to execute scripts in the browsers of users viewing the rendered content. | ||||
| CVE-2024-58404 | 2026-11-13 | 7.7 High | ||
| Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via the name query parameter. Authenticated attackers can bypass the user id check and use directory traversal sequences to read arbitrary files on the server host. | ||||
| CVE-2024-58405 | 2026-11-13 | 8.6 High | ||
| Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which enforces invite codes only when user registration is disabled, so registration succeeds without an invite when both invites and user registration are enabled. Unauthenticated attackers can send a direct POST request omitting the invite code to create accounts, view stats, and exhaust storage by uploading many files. | ||||
| CVE-2025-71459 | 2026-11-13 | 8.1 High | ||
| Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files outside the upload directory by supplying traversal sequences in the x-zipline-filename header. Attackers using the local datasource can create or overwrite files writable by the Zipline process, corrupting application data or disrupting service. | ||||
| CVE-2025-71460 | 2026-11-13 | 4.2 Medium | ||
| Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that allows authenticated users to modify other users' files due to absent ownership checks. Attackers who know a target file ID can submit transaction requests to edit or delete files belonging to any user. | ||||
| CVE-2025-71461 | 2026-11-13 | 5.3 Medium | ||
| Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload filenames by recovering the Math.random generator state. Attackers with five consecutive gfycat-style filenames can reconstruct the random state to predict previous and future filenames until the instance restarts, exposing private uploads. | ||||
| CVE-2025-71462 | 2026-11-13 | 6.1 Medium | ||
| Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute JavaScript by supplying an unvalidated url parameter. Attackers can craft a login link with a javascript: URI in the url parameter that executes in the victim's browser after login. | ||||
| CVE-2025-71463 | 1 Scapy | 1 Scapy | 2026-11-13 | 6.7 Medium |
| Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__(). | ||||
| CVE-2026-126264 | 1 B3log | 1 Siyuan | 2026-11-13 | 7.7 High |
| SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets. | ||||
| CVE-2026-126265 | 1 B3log | 1 Siyuan | 2026-11-13 | 7.4 High |
| SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie, allowing reuse of a solved challenge. Attackers can replay the original signed siyuan cookie with distinct wrong access codes to brute-force the code and gain an administrator session. | ||||
| CVE-2026-126266 | 1 B3log | 1 Siyuan | 2026-11-13 | 7.5 High |
| SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field. | ||||
| CVE-2026-126267 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 6.5 Medium |
| NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding errors in the unawaited logHelper call that terminate the server process. | ||||
| CVE-2026-126268 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 5.3 Medium |
| NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge their recorded source IP by supplying X-Forwarded-For headers, because Express trust proxy is enabled unconditionally. Attackers can write arbitrary source addresses into audit and request logs to mislead investigations and evade the per-address public API rate limiter. | ||||
| CVE-2026-126269 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 8.7 High |
| NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so the /dltemp signed URL serves HTML inline, stealing session tokens from localStorage to impersonate victims. | ||||
| CVE-2026-126270 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 6.5 Medium |
| NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load. | ||||
| CVE-2026-126271 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 7.7 High |
| NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key, client certificate and CA to connect directly to the external database, bypassing NocoDB permissions. | ||||
| CVE-2026-126272 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 6.5 Medium |
| NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass bulk row-count limits by using session authentication instead of API tokens. Attackers with Editor write permission on one table can submit hundreds of thousands of rows to v1 and v2 bulk write routes, exhausting database connections, CPU, and memory. | ||||
| CVE-2026-126273 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 8.1 High |
| NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control. | ||||
| CVE-2026-126274 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 8.7 High |
| NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage. | ||||
| CVE-2026-126275 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 7.1 High |
| NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plant decoy tables and duplicate comment ids to spoof teammates' comments. | ||||