Export limit exceeded: 385063 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 385063 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 385063 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 385063 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (385063 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82455 | 1 Rubygems | 1 Rubygems | 2026-08-31 | 7.1 High |
| RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory. | ||||
| CVE-2026-82454 | 1 Omnivore-app | 1 Omnivore | 2026-08-31 | 9.1 Critical |
| The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account. | ||||
| CVE-2026-82453 | 1 Iot-ecology | 1 Rust-iot-platform | 2026-08-31 | 7.5 High |
| rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts. | ||||
| CVE-2026-82450 | 1 Bookstackapp | 1 Bookstack | 2026-08-31 | 8.8 High |
| BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests. | ||||
| CVE-2026-82449 | 1 Cockpit-hq | 1 Cockpit | 2026-08-31 | 5.3 Medium |
| Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcrypt verification while non-existent accounts return immediately. | ||||
| CVE-2026-82448 | 1 Shinobi Systems | 1 Shinobi | 2026-08-31 | 9.8 Critical |
| Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration. | ||||
| CVE-2026-82421 | 1 Itsourcecode | 1 Sales And Inventory System | 2026-08-31 | 6.3 Medium |
| A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/emp_edit.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-82329 | 1 Jfrog | 1 Artifactory | 2026-08-31 | 9.8 Critical |
| JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to obtain administrative privileges. | ||||
| CVE-2026-82306 | 1 Starrocks | 1 Starrocks | 2026-08-31 | 6.5 Medium |
| StarRocks through 4.0.13 contains an information disclosure vulnerability in the query_detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other users, including statements containing credentials. | ||||
| CVE-2026-82290 | 1 Chainlit | 1 Chainlit | 2026-08-31 | 5.3 Medium |
| Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation. | ||||
| CVE-2026-82287 | 1 Rybbit-io | 1 Rybbit | 2026-08-31 | 8.1 High |
| Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website to read analytics data, account information, and perform authenticated state-changing operations as the victim user. | ||||
| CVE-2026-82285 | 1 Dataelement | 1 Bisheng | 2026-08-31 | 8.2 High |
| bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names. | ||||
| CVE-2026-82282 | 1 Runatlantis | 1 Atlantis | 2026-08-31 | 8 High |
| Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery. | ||||
| CVE-2026-82280 | 1 Quivr | 1 Quivr | 2026-08-31 | 7.1 High |
| Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users. | ||||
| CVE-2026-82277 | 2026-08-31 | 9.8 Critical | ||
| Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig. | ||||
| CVE-2026-82275 | 1 Qwenlm | 1 Qwen-agent | 2026-08-31 | 7.5 High |
| Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary files accessible by the server process. | ||||
| CVE-2026-82272 | 1 Immich-app | 1 Immich | 2026-08-31 | 6.5 Medium |
| Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links, bypassing the locked visibility protection. | ||||
| CVE-2026-82270 | 1 Portkey-ai | 1 Gateway | 2026-08-31 | 7.5 High |
| Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal services and exfiltrate provider API keys. | ||||
| CVE-2026-82267 | 1 Moghtech | 1 Komodo | 2026-08-31 | 5.4 Medium |
| Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations. | ||||
| CVE-2026-82265 | 1 Openzipkin | 1 Zipkin | 2026-08-31 | 6.5 Medium |
| Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging. | ||||