Export limit exceeded: 418277 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (418277 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-62991 | 1 Shopperlabs | 1 Shopper | 2026-11-02 | 6.5 Medium |
| Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID without applying the `customers` role scope used by the listing. Authenticated staff holding `access_dashboard` and `read_customers` can change the user ID to retrieve administrator or staff profiles despite lacking `view_users`, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds `delete_customers`, `anonymizeAction()` operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1. | ||||
| CVE-2026-57187 | 1 Asterisk | 2 Asterisk, Certified Asterisk | 2026-11-02 | 6.5 Medium |
| Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in `PJSIP TCP/SDP` handling by sending a `SIP INVITE` over a connection-oriented transport and disconnecting before Asterisk responds with the `200 OK`. So far, the crash has only been reproduced when Asterisk is built with `Address Sanitizer`, which detects the issue. `Address Sanitizer` is a development tool with significant performance overhead and, according to the maintainer, is not used in production systems. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3. | ||||
| CVE-2026-55612 | 2026-11-02 | 3.7 Low | ||
| uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length line, such as a size exceeding INT_MAX, then clears `r->content_length` and `r->transfer_chunked` without draining the remaining body or setting `request.connection_close`. The completion check treats the chunked POST as finished and the keep-alive parser returns to `CLIENT_STATE_INIT`. Attacker-controlled body bytes aligned as a complete HTTP request are then parsed and processed as another request on the same connection, causing HTTP request smuggling and request-boundary desynchronization. Commits b78f518478794e16ba3568fc1258e40bf3e8eb3b and 34460b8211d676ef1b9f40d6b775c5e112933690 patch the issue. | ||||
| CVE-2026-117540 | 1 Svg-sanitizer Project | 1 Svg-sanitizer | 2026-11-02 | 7.5 High |
| svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes. | ||||
| CVE-2026-117532 | 1 Redaxo | 2 Core, Redaxo | 2026-11-02 | 9.8 Critical |
| REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode. | ||||
| CVE-2026-116897 | 1 Redaxo | 2 Core, Redaxo | 2026-11-02 | 6.5 Medium |
| REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content. | ||||
| CVE-2026-116893 | 1 Redaxo | 2 Core, Redaxo | 2026-11-02 | 6.8 Medium |
| REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like structure (dropping their database tables), deactivate, install, or activate packages, and delete non-system packages. | ||||
| CVE-2026-116889 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-11-02 | 6.1 Medium |
| SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject script through Code-typed property values. Attackers can annotate a valid JSON value embedding HTML markup, which the CodeStringValueFormatter renders unescaped on Special:Browse, executing JavaScript in viewers' sessions. | ||||
| CVE-2026-116885 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-11-02 | 6.1 Medium |
| Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdmin ID lookup that allows unauthenticated attackers to inject markup through the unescaped id parameter. Attackers can lure an smw-admin administrator into opening a crafted lookup link, bypassing the auto-satisfied edit-token check, to execute script and perform privileged actions in the administrator's session. | ||||
| CVE-2026-116881 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-11-02 | 6.1 Medium |
| Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject markup by storing malicious semantic property values rendered unescaped in autocomplete suggestions. When another user opens the property-value autocomplete with an empty query, jquery.autocomplete.js concatenates the raw PValueLookup API value into HTML via container.html(), altering the dropdown and potentially executing script. | ||||
| CVE-2026-116877 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-11-02 | 6.5 Medium |
| Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_event without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources. | ||||
| CVE-2026-116873 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-11-02 | 7.3 High |
| Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous CSRF token with run-joblist to execute arbitrary job types in unbounded counts, or invoke update on sysop-protected pages, leaking page titles and exhausting resources. | ||||
| CVE-2026-116843 | 1 Mistral | 1 Mistral-vibe | 2026-11-02 | 8.8 High |
| Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges. | ||||
| CVE-2026-116829 | 2 Ggml, Ggml-org | 2 Llama.cpp, Llama.cpp | 2026-11-02 | 6.6 Medium |
| llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows attackers to bypass tensor element-count validation by supplying shapes whose product wraps to zero. Attackers can craft GGUF files with enormous tensor extents that overflow ggml_nbytes() and strides, causing out-of-bounds memory access when buffers are sized from wrapped byte counts. | ||||
| CVE-2026-116825 | 1 Yeswiki | 1 Yeswiki | 2026-11-02 | 6.5 Medium |
| YesWiki from 4.6.2 before 4.7.0 lacks replay protection in HttpSignatureService::verifySignature(), which never validates the Date header or tracks seen signatures. Attackers who capture a signed request to the /api/forms/{formId}/actor/inbox endpoint can replay it later to re-execute Delete, Update, Follow, or Undo actions. | ||||
| CVE-2026-116821 | 1 Yeswiki | 1 Yeswiki | 2026-11-02 | 6.5 Medium |
| YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into SQL LIKE patterns without escaping the _ and % wildcards. Self-registered attackers can use usernames such as ___ or %%% that over-match ACL tokens, reading pages and Bazar entries restricted to other users or groups via the public Bazar listing API. | ||||
| CVE-2026-116817 | 1 Openpanel | 1 Openpanel | 2026-11-02 | 6.5 Medium |
| OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access the Bull Board dashboard served on the worker HTTP port. Attackers can query /api/queues and call mutating Bull Board APIs to add, retry, or clean jobs and read queue data, metrics, and datastore health. | ||||
| CVE-2026-116812 | 1 Openpanel | 1 Openpanel | 2026-11-02 | 6.5 Medium |
| OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by supplying unescaped profile filter column names. Attackers can submit a cohort.preview filter whose name contains a subquery spliced into argMax, cityHash64, or comparison clauses to read other tenants' ClickHouse data. | ||||
| CVE-2026-116808 | 1 Openpanel | 1 Openpanel | 2026-11-02 | 7.2 High |
| OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projects' profiles, events, and sessions. | ||||
| CVE-2026-116804 | 1 Cure53 | 1 Dompurify | 2026-11-02 | 6.1 Medium |
| DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expressions in attached shadow roots when using RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE modes. Attackers can split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines for cross-site scripting. | ||||