Export limit exceeded: 381531 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 381531 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (381531 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-74234 | 1 Legora | 1 Legora | 2026-08-21 | 7.7 High |
| Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval() before any SVG sanitization occurs. Attackers can exploit this flaw through influenced Mermaid diagram content to execute arbitrary JavaScript in the user's browser context, with elevated impact on Word and Outlook add-in surfaces where bearer session tokens are persisted in localStorage. | ||||
| CVE-2026-75103 | 1 Crawlab-team | 1 Crawlab | 2026-08-21 | 8.8 High |
| Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution. | ||||
| CVE-2026-75106 | 1 Opnform | 1 Opnform | 2026-08-21 | 9.1 Critical |
| OpnForm derives editable-submission secrets from sequential row identifiers using Hashids with an empty default salt, allowing unauthenticated attackers to compute hashes for any submission. Attackers can read other respondents' full submission data through the submission-fetch endpoint or overwrite submissions by supplying predicted hashes to the answer endpoint. | ||||
| CVE-2026-75108 | 1 Next-terminal | 1 Next-terminal | 2026-08-21 | 5.4 Medium |
| Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identifiers to retrieve asset information including display names, reachability status, connection timing, and network addresses, or trigger wake-on-LAN packets on unauthorized assets. | ||||
| CVE-2026-75109 | 1 Determined-ai | 1 Determined | 2026-08-21 | 7.1 High |
| Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own. | ||||
| CVE-2026-75110 | 1 Memtensor | 1 Memos | 2026-08-21 | 9.8 Critical |
| MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled (AUTH_ENABLED=true) but the undocumented, defaultless INTERNAL_SERVICE_SECRET environment variable is unset, the is_internal_request() check in src/memos/api/middleware/auth.py fails open: os.getenv("INTERNAL_SERVICE_SECRET") returns None and a request omitting the X-Internal-Service header also yields None, so the comparison None == None evaluates true. The request is then treated as a trusted internal principal and granted scopes: ["all"]. As a result, an unauthenticated remote attacker can reach the admin API-key management endpoints to mint API keys for any user, enumerate keys, revoke keys, and generate a master key for persistent privileged access, as well as all data endpoints. | ||||
| CVE-2026-75111 | 1 Evidentlyai | 1 Evidently | 2026-08-21 | 7.5 High |
| Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoint, allowing unauthenticated attackers to read arbitrary files outside the workspace directory. Attackers can supply traversal sequences or absolute paths in the filename field to access system files, which are then materialized into datasets and retrieved through the download endpoint. | ||||
| CVE-2026-75482 | 1 Swe-agent | 1 Swe-agent | 2026-08-21 | 7.5 High |
| SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory ('..') references, bypassing the built-in path sanitization. The server binds all interfaces (0.0.0.0), applies wildcard CORS, and requires no authentication. An unauthenticated network client (or a malicious web page via CORS) can use path traversal sequences to read files outside the intended directory. Because the read sink parses targets as trajectory JSON, disclosure is constrained to JSON files shaped like a trajectory, which can contain repository contents, command output, and secrets/API keys. | ||||
| CVE-2026-75483 | 1 Romkatv | 1 Powerlevel10k | 2026-08-21 | 3.3 Low |
| powerlevel10k fails to neutralize control characters in the package.json version field when rendering the package prompt segment. Attackers can inject raw escape bytes in the version string to emit arbitrary terminal control sequences on each prompt render when the shell enters affected directories. | ||||
| CVE-2026-71424 | 1 Onyx | 1 Onyx | 2026-08-21 | 9.6 Critical |
| Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/{persona_id} endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.set_tokens and OnyxTokenStorage.set_client_info in backend/onyx/server/features/mcp/api.py copy per-user tokens into a shared admin MCPConnectionConfig row and _db_mcp_server_to_api_mcp_server returns that row through auth_template.headers to any BASIC_ACCESS user. This issue is fixed in versions 3.1.10, 3.2.14, and 4.0.0. | ||||
| CVE-2026-63178 | 1 Onyx | 1 Onyx | 2026-08-21 | 6.5 Medium |
| Onyx is an open-source AI platform. Prior to 4.3.0, Onyx Enterprise Edition's PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints in ee/onyx/server/user_group/api.py call update_user_group and add_users_to_user_group in ee/onyx/db/user_group.py without enforcing _validate_curator_can_modify_group, allowing a curator to add accounts to arbitrary groups and obtain document access through get_acl_for_user and the OpenSearch access_control_list filter. This issue is fixed in version 4.3.0. | ||||
| CVE-2026-11801 | 2 Gwin, Wordpress | 2 Wpadverts – Classifieds Plugin, Wordpress | 2026-08-21 | 7.5 High |
| The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys. | ||||
| CVE-2026-75091 | 2 Mdmag, Wordpress | 2 Quill Forms | Conversational Multi Step Forms, Surveys & Quizzes, Wordpress | 2026-08-21 | 7.2 High |
| The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-75626 | 1 Smicallef | 1 Spiderfoot | 2026-08-21 | 9.3 Critical |
| SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is opened, potentially stealing API keys. | ||||
| CVE-2026-19447 | 1 Fileorbis | 1 Fileorbis | 2026-08-21 | 5.4 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5. | ||||
| CVE-2026-15585 | 1 Akin | 1 Akinsoft Wolvox9 Erp / Kontrolpanel.exe | 2026-08-21 | 7.5 High |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP / KontrolPanel.exe allows Path Traversal. This issue affects AKINSOFT Wolvox9 ERP / KontrolPanel.exe: from s26.02.17 before 26.02.22. | ||||
| CVE-2026-5224 | 1 Kriptok Crypto | 1 Cryptosim | 2026-08-21 | 5.7 Medium |
| Cleartext storage of sensitive information vulnerability in Kriptok Crypto and Information Technologies Industry Trade Inc. Cryptosim allows Retrieve Embedded Sensitive Data. This issue affects Cryptosim: before 3.1.0.229. | ||||
| CVE-2026-16309 | 1 Netiket Information Technologies | 1 Edoweb | 2026-08-21 | 5.3 Medium |
| Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7. | ||||
| CVE-2026-50575 | 1 Unitronix | 1 Betterdesk | 2026-08-21 | 7.7 High |
| BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available. | ||||
| CVE-2026-28567 | 2 Fahad Mahmood, Wordpress | 2 Wp Sort Order, Wordpress | 2026-08-21 | 7.5 High |
| Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions. | ||||