Export limit exceeded: 420559 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420559 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123059 | 2026-11-05 | 7.5 High | ||
| In Eclipse BaSyx Helm Charts version 2.2.0 of the `aas-basyx-v2-full` chart, deployments with the bundled Keycloak enabled store the client secret of the `basyx-technical-user` OAuth2 client in cleartext in a Kubernetes ConfigMap. This client uses the client-credentials grant and its service account holds the realm `admin` role. The chart correctly writes `keycloak.technicalUser.clientSecret` to a Kubernetes Secret, but the template `basyx-keycloak-realm.yaml` also substitutes the same value into the Keycloak realm-import JSON, which is stored in the ConfigMap `<keycloak.fullnameOverride>-realm`. A principal that can read ConfigMaps but not Secrets in the release namespace, such as a holder of the built-in Kubernetes `view` ClusterRole, can read the client secret from the ConfigMap. They can then exchange it at the Keycloak token endpoint for an access token with the `admin` role. That token grants full create, read, update, delete and execute rights on all BaSyx repositories and registries in the deployment. The bundled Keycloak is disabled by default. No fixed release of the `aas-basyx-v2-full` chart exists. Affected users should migrate to the `basyx` chart, or deploy without the bundled Keycloak and rotate the `basyx-technical-user` client secret. | ||||
| CVE-2026-123024 | 1 Agentscope-ai | 1 Agentscope | 2026-11-05 | 7.3 High |
| A vulnerability has been found in agentscope-ai AgentScope up to 2.0.11. This impacts the function get_current_user_id of the file src/agentscope/app/deps.py of the component Agent Service. Such manipulation of the argument X-User-ID leads to missing authentication. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The pull request to fix this issue awaits acceptance. | ||||
| CVE-2026-123017 | 2026-11-05 | 6.5 Medium | ||
| GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server. A grant_gold(1000000) call can be forged. | ||||
| CVE-2026-120463 | 1 Sassanix | 1 Warracker | 2026-11-05 | 6.5 Medium |
| Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the `other` document type. Attackers can exploit insufficient authorization checks in the `paperless_search_and_link()` and `serve_paperless_document()` route handlers in file_routes.py to retrieve and disclose private documents belonging to another user via the shared Paperless-ngx API credential, resulting in unauthorized read access and confidentiality loss. | ||||
| CVE-2026-120454 | 1 Sleuthkit | 1 The Sleuth Kit | 2026-11-05 | 5.5 Medium |
| The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that allows attackers to crash the tool by supplying a crafted HFS+ image. Attackers can set a huge uncompressed_size in an LZVN inline com.apple.decmpfs attribute so allocation fails and the decoder writes through NULL, causing denial of service. | ||||
| CVE-2026-120446 | 1 Madong-code | 1 Madong-admin-saas | 2026-11-05 | 9.4 Critical |
| madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API because the 'platformapi' middleware key never matches the 'platform' application. Unauthenticated remote attackers can call /platformapi/tenant/account, bind-plan and sync-data endpoints to list, create, modify, disable or delete tenants and bind subscription plans. | ||||
| CVE-2026-120430 | 1 Owen2345 | 1 Camaleon Cms | 2026-11-05 | 5.4 Medium |
| Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized for one post type can send update or destroy requests pairing another category ID with their authorized post_type_id to rename or delete categories. | ||||
| CVE-2026-120426 | 1 Opencsg | 1 Csghub | 2026-11-05 | 7.5 High |
| OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded current_user parameter into the file path, which the portal forwards with its server API key, to read files in private model, code or space repositories. | ||||
| CVE-2026-120345 | 1 Wavlink | 1 Wn551x3-a | 2026-11-05 | 10 Critical |
| A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-119712 | 2 Pipeshub, Pipeshub-ai | 2 Pipeshub, Pipeshub-ai | 2026-11-05 | 6.4 Medium |
| PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content. | ||||
| CVE-2026-119708 | 1 Colinin | 1 Abp-next-admin | 2026-11-05 | 6.5 Medium |
| abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant. | ||||
| CVE-2026-119704 | 1 Bastillebsd | 1 Bastille | 2026-11-05 | 6.8 Medium |
| Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. Attackers inside a jail can plant symlinks pointing to host paths or other jail roots, so administrator-run copies overwrite or read host files with root privileges. | ||||
| CVE-2026-119700 | 2 Wordpress-extensions, Wpgraphql | 2 Wpgraphql, Wpgraphql | 2026-11-05 | 5.3 Medium |
| WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to determine object existence through distinct error responses. Attackers can iterate IDs against deleteMediaItem, updateMediaItem, deleteComment and updateComment mutations to discover hidden draft, private, trashed posts, custom post types, and unapproved comments. | ||||
| CVE-2026-119664 | 1 Wannabespace | 1 Tamery | 2026-11-05 | 4.3 Medium |
| Tamery (formerly Conar) 0.26.1 before 0.99.0 contains an authorization bypass vulnerability in the cloud sync API chatsMessages.update handler, which leaves the client-supplied chatId writable. Authenticated Pro subscribers who know another user's chat ID can move messages with arbitrary parts and metadata into the victim's AI chat history. | ||||
| CVE-2026-119660 | 1 Yincongcyincong | 1 Musebot | 2026-11-05 | 9.8 Critical |
| MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session cookie carrying a user_id to gain full administrative access, reading password hashes, chat records, and bot configuration, and stopping bots. | ||||
| CVE-2026-119656 | 1 Coreshop | 1 Coreshop | 2026-11-05 | 7.5 High |
| CoreShop by CoreUnion through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Agent/GetGoodsPageList endpoint via the order parameter appended to an ORDER BY clause. Anonymous attackers can inject subqueries that bypass SqlSugar's field check to extract member accounts and orders through boolean-based or time-based blind techniques. | ||||
| CVE-2026-119652 | 1 Hulaspark | 1 Hula-server | 2026-11-05 | 4.3 Medium |
| HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET requests to /user/friend/page with a victim's uid, bypassing the missing administrator or owner check to read any user's contact list. | ||||
| CVE-2026-119648 | 1 Tencent | 1 Blueking Cmdb | 2026-11-05 | 4.3 Medium |
| Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search conditions targeting other businesses or omitting business filters to retrieve host attributes and topology association details, because the route is mapped to SkipAction and SearchHostWithAsstDetail skips AuthorizeSearchHost. | ||||
| CVE-2026-119644 | 1 Wangyunf | 1 Blossom | 2026-11-05 | 5.4 Medium |
| Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/batch, or /picture/star endpoints to permanently delete victims' images and stored files or change their star status. | ||||
| CVE-2026-119601 | 1 Afflib Project | 1 Afflib | 2026-11-05 | 6.1 Medium |
| AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size larger than and not a multiple of the sector size, causing the sector zero-fill loop to write past the buffer and crash forensic tools. | ||||