Export limit exceeded: 425975 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425975 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-90993 | 1 Apache | 1 Xml Graphics Batik | 2026-11-13 | N/A |
| XXE vulnerability in Apache XML Graphics Batik. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue. | ||||
| CVE-2026-91007 | 1 Zephyrproject | 1 Zephyr | 2026-11-13 | 7.8 High |
| The user-mode syscall verifiers for the charger driver API in drivers/charger/charger_handlers.c did not inspect the prop argument before copying union charger_propval across the user/kernel boundary. Two members of that union are function pointers — status_notification (CHARGER_PROP_STATUS_NOTIFICATION) and online_notification (CHARGER_PROP_ONLINE_NOTIFICATION), declared in include/zephyr/drivers/charger.h — and z_vrfy_charger_set_prop() forwarded the caller-supplied union verbatim to the driver's set_property callback for any property. z_vrfy_charger_get_prop() had the mirror defect and copied the stored kernel callback address back out to user memory. With CONFIG_USERSPACE enabled, any user-mode thread that has been granted a charger device object could call charger_set_prop() with CHARGER_PROP_STATUS_NOTIFICATION or CHARGER_PROP_ONLINE_NOTIFICATION and an arbitrary pointer value. Drivers that implement these properties — drivers/charger/charger_max20335.c, drivers/charger/charger_pf1550.c and drivers/charger/charger_bq2518x.c — store the pointer in device data and later invoke it from their interrupt work handlers, which run in supervisor mode, on any charger state change such as a cable plug/unplug. The result is a control-flow hijack at kernel privilege from an unprivileged thread, defeating the isolation that CONFIG_USERSPACE is meant to provide; the read path additionally disclosed a kernel code address to user mode, and clearing a notifier installed by a supervisor thread let user mode suppress charger notifications. Supervisor-mode callers of charger_set_prop()/charger_get_prop() are unaffected. The fix makes both verifiers reject the two notifier properties outright — including when the supplied callback is NULL, since the notifiers are device state — and adds a BUILD_ASSERT on CHARGER_PROP_COMMON_COUNT so that new properties force a re-review of the union's user-mode safety. | ||||
| CVE-2026-112182 | 1 Openkm | 1 Openkm Community Edition | 2026-11-13 | N/A |
| Unauthorization vulnerability in the management of workflow definitions in OpenKM Community Edition. The REST endpoints `registerProcessDefinition` and `runProcessDefinition` require authentication but do not verify roles in the WorkflowService or in lower layers. An attacker with the `ROLE_USER` role can register and execute a process definition containing BeanShell scripts, allowing them to execute Java code and operating system commands with the service’s privileges. In the official Docker image, the process runs as root. | ||||
| CVE-2026-112181 | 1 Openkm | 1 Openkm Community Edition | 2026-11-13 | N/A |
| Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community Edition. The XML processing in FormUtils / LocalEntityResolver does not properly restrict the resolution of external resources. An authenticated remote attacker with the ROLE_USER role can exploit the flaw via a REST request. In the 6.3.x branch, this allows the attacker to trigger HTTP requests under their control (SSRF); in 7.0.3, it allows the attacker to read local files and access internal HTTP resources from the server. | ||||
| CVE-2026-120869 | 2026-11-13 | N/A | ||
| An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance | ||||
| CVE-2026-94125 | 1 Apache | 1 Storm | 2026-11-13 | N/A |
| Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run. Users are recommended to upgrade to version 3.2.0, which fixes the issue. | ||||
| CVE-2025-71463 | 1 Scapy | 1 Scapy | 2026-11-13 | 6.7 Medium |
| Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows attackers to execute code by supplying a malicious pickle session file. Attackers can trick users into loading a crafted .pkl.gz file via the -s option or conf.session, executing embedded Python code through __reduce__(). | ||||
| CVE-2026-126266 | 1 B3log | 1 Siyuan | 2026-11-13 | 7.5 High |
| SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field. | ||||
| CVE-2026-126267 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 6.5 Medium |
| NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding errors in the unawaited logHelper call that terminate the server process. | ||||
| CVE-2026-126268 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 5.3 Medium |
| NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge their recorded source IP by supplying X-Forwarded-For headers, because Express trust proxy is enabled unconditionally. Attackers can write arbitrary source addresses into audit and request logs to mislead investigations and evade the per-address public API rate limiter. | ||||
| CVE-2026-126269 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 8.7 High |
| NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so the /dltemp signed URL serves HTML inline, stealing session tokens from localStorage to impersonate victims. | ||||
| CVE-2026-126270 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 6.5 Medium |
| NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load. | ||||
| CVE-2026-126271 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 7.7 High |
| NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key, client certificate and CA to connect directly to the external database, bypassing NocoDB permissions. | ||||
| CVE-2026-126272 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 6.5 Medium |
| NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass bulk row-count limits by using session authentication instead of API tokens. Attackers with Editor write permission on one table can submit hundreds of thousands of rows to v1 and v2 bulk write routes, exhausting database connections, CPU, and memory. | ||||
| CVE-2026-126273 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 8.1 High |
| NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control. | ||||
| CVE-2026-126274 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 8.7 High |
| NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage. | ||||
| CVE-2026-126275 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 7.1 High |
| NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to read cross-base row comments by supplying only model and row ids. Attackers with a Viewer or Creator role on an unrelated base can read private comments and author emails, or plant decoy tables and duplicate comment ids to spoof teammates' comments. | ||||
| CVE-2026-126276 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 6.3 Medium |
| NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a substitute for confidential client authentication, skipping client secret verification when omitted. Attackers holding a captured authorization code and PKCE verifier can mint access tokens and 60-day refresh tokens for a confidential client without knowing its secret. | ||||
| CVE-2026-126277 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 7.5 High |
| NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust server resources by sending unbounded filter arrays to shared-view bulk endpoints. Attackers with a shared view UUID can POST a large body of minimal filter objects, triggering a full database query per entry, to crash the NocoDB process. | ||||
| CVE-2026-126278 | 1 Nocodb | 1 Nocodb | 2026-11-13 | 7.5 High |
| NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid reset token to perform multiple password changes by sending concurrent reset requests. Attackers can exploit the window created by slow bcrypt hashing before the token is cleared to overwrite the owner's new password and lock them out. | ||||