Export limit exceeded: 409421 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409421 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-111607 | 1 Jeequan | 1 Jeepay | 2026-10-17 | 7.1 High |
| Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInterfaceConfigController.saveOrUpdate. Attackers holding the default ENT_MCH_PAY_CONFIG_ADD permission can replace signing keys, certificates, and fee rates to break or redirect the victim merchant's payment processing. | ||||
| CVE-2026-111608 | 1 Jeequan | 1 Jeepay | 2026-10-17 | 4.2 Medium |
| Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holding ENT_DIVISION_RECEIVER_DELETE who own a receiver group whose id matches a victim's receiver id can delete the victim's profit-sharing receiver. | ||||
| CVE-2026-92088 | 1 Upkeeper Solutions | 1 Upkeeper Instant Privlege Access | 2026-10-17 | N/A |
| Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation. This issue affects upKeeper Instant Privilege Access: through 1.7.1. | ||||
| CVE-2026-111347 | 1 Opsre | 1 Go-ldap-admin | 2026-10-17 | 5.9 Medium |
| go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords. Unauthenticated attackers who capture encrypted passwords can decrypt them offline or via the /base/decryptpwd endpoint, recovering cleartext LDAP credentials for reuse. | ||||
| CVE-2026-111619 | 1 Zyx0814 | 1 Filepress | 2026-10-17 | 6.5 Medium |
| FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries in dzz/pichome/library/filelist.php and dzz/collection/filelist.php to extract database rows including administrator credential hashes. | ||||
| CVE-2026-111620 | 2 O2oa, Zoneland | 2 O2oa, O2oa | 2026-10-17 | 5.3 Medium |
| O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the referenced work or draft, so any visitable work or owned draft can be supplied. Attackers who know an attachment UUID can request it through jaxrs/attachment/download/{id}/work/{workId} to read documents attached to other users' processes. | ||||
| CVE-2026-111621 | 1 Tduckcloud | 1 Tduck-survey-form | 2026-10-17 | 4.3 Medium |
| TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from a public fill link to obtain the form write password, owner notification e-mail, and WeChat openIds. | ||||
| CVE-2026-95904 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 5.5 Medium |
| Buffer over-read in Windows Event Logging Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-111349 | 1 Puemos | 1 Craftplan | 2026-10-17 | 5.3 Medium |
| Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /api/json/customers or the create_customer mutation to insert attacker-chosen names, contact details and addresses into the operator's CRM. | ||||
| CVE-2026-111351 | 1 Metasfresh | 1 Metasfresh | 2026-10-17 | 4.2 Medium |
| metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows authenticated low-privilege users to bypass role and organization access checks. Attackers can call the getBoard, getCard, addCard, removeCard and patchCard handlers to read records outside their scope and modify board card assignments. | ||||
| CVE-2026-111363 | 1 Dataelement | 1 Bisheng | 2026-10-17 | 6.5 Medium |
| BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated low-privileged users to read other users' parsed documents by supplying arbitrary file_id values. Attackers can enumerate sequential file ids against GET /api/v1/knowledge/file_bbox to retrieve extracted page text from other users' and tenants' knowledge bases. | ||||
| CVE-2026-70288 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 5.5 Medium |
| Time-of-check time-of-use (toctou) race condition in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-111383 | 1 Nezhahq | 1 Nezha | 2026-10-17 | 6.5 Medium |
| Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections. | ||||
| CVE-2026-111384 | 1 Nezhahq | 1 Nezha | 2026-10-17 | 6.5 Medium |
| Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring. | ||||
| CVE-2026-111386 | 1 Nezhahq | 1 Nezha | 2026-10-17 | 4.3 Medium |
| Nezha from 1.7.0 before 2.3.15 contains an information disclosure vulnerability that allows authenticated members to enumerate other tenants' server IDs through differential responses. Attackers can sweep sequential IDs against getServerConfig and setServerConfig, distinguishing 'permission denied' from success payloads to map other users' servers. | ||||
| CVE-2026-111387 | 1 Nezhahq | 1 Nezha | 2026-10-17 | 6.5 Medium |
| Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party credentials because listDDNS omits WebhookURL and WebhookRequestBody redaction. Admins or PATs with nezha:ddns:read scope can call GET /api/v1/ddns to read cleartext tokens embedded in every user's DDNS webhook profiles. | ||||
| CVE-2026-111389 | 1 Frappe | 1 Hrms | 2026-10-17 | 7.7 High |
| Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints caused by missing input validation. Any authenticated attacker, including a low-privilege account, can send specially crafted requests to these endpoints to extract sensitive information from the database. | ||||
| CVE-2026-110855 | 2 Gitpython-developers, Gitpython Project | 2 Gitpython, Gitpython | 2026-10-17 | 6.5 Medium |
| GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables via separate_git_dir in Repo._clone(), which omits expand_vars=False when calling Git.polish_url(). Attackers can craft a .gitmodules submodule name containing variable syntax so that clone plus submodule_update exposes secrets in .git/modules directory names and DEBUG logs. | ||||
| CVE-2026-110860 | 2 Gitpython-developers, Gitpython Project | 2 Gitpython, Gitpython | 2026-10-17 | 6.1 Medium |
| GitPython from 3.1.62 before 3.2.0 contains a symlink-following flaw in Submodule.move(), which checks the destination only lexically and does not reject symbolic links in intermediate path components. An untrusted repository can commit a symlink such as vendor pointing outside the worktree, so an application moving an initialized submodule beneath it relocates the checkout externally and corrupts the index and .gitmodules. | ||||
| CVE-2026-111235 | 1 The Opennms Group | 2 Horizon, Meridian | 2026-10-17 | 9.1 Critical |
| An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an uppercase token, compare the method case-sensitively, and have no terminal deny rule. A request that uses a non-canonical (for example lowercase) method token matches no rule and is processed without authentication. A remote, unauthenticated attacker can read the monitored inventory and can create, modify, or delete resources through the REST API, which includes injecting events to fabricate or suppress alarms. The /rest/alarms chain has the same missing deny rule and discloses whether an alarm exists through a difference in the response. The fix adds a terminal deny rule to each REST filter chain. The solution is to upgrade to Meridian 2024.3.14, 2025.0.11, 2026.0.1 and Horizon 36.0.5 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. | ||||