Export limit exceeded: 417953 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417953 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110075 | 1 Adobe | 2 Adobe Experience Manager, Experience Manager | 2026-10-29 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-61451 | 1 Getgrav | 2 Grav, Grav-plugin-api | 2026-10-29 | 9.6 Critical |
| The Grav API plugin (grav-plugin-api) before 1.0.4 does not validate the origin of the client-supplied admin_base_url field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl() function only checks that the URL scheme is http/https and never verifies the host against the server's own origin, so an attacker can supply an arbitrary host. As a result, an unauthenticated attacker can cause the password reset email sent to a victim to contain a reset link pointing at an attacker-controlled server; when the victim follows the link, the valid reset token is disclosed to the attacker, enabling full account takeover. The vulnerable base URL can also be influenced via the Referer or Origin headers. | ||||
| CVE-2026-58660 | 1 Kanboard | 1 Kanboard | 2026-10-29 | 8.1 High |
| Kanboard before 1.2.53, fixed in commit 564cc30, BoardAjaxController save() method (used by the kanban board drag-and-drop endpoint) validates the caller's role on the attacker-supplied project_id but never verifies that the supplied task_id actually belongs to that project. Because task identifiers are sequential integers shared across the entire instance, any authenticated user who is a member of at least one project can enumerate and move (corrupt/hide) tasks belonging to any other project on the same instance, including private projects they have no membership or role on. | ||||
| CVE-2026-109266 | 1 Imagemagick | 1 Imagemagick | 2026-10-29 | 5.3 Medium |
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an XML injection vulnerability in the CIP encoder, which does not properly escape input-derived data when writing Cisco IP Phone XML output. Attackers can supply a crafted file that, when converted to CIP format, injects arbitrary markup into the generated XML. | ||||
| CVE-2026-104436 | 2 Zcashfoundation, Zfnd | 3 Zebra, Zebra, Zebra-chain | 2026-10-29 | 3.7 Low |
| Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads by sending oversized block locator vectors. Attackers can send getblocks or getheaders messages with up to 65,535 locator hashes, triggering per-hash chain lookups that degrade block validation, RPC, and mempool performance. | ||||
| CVE-2026-100709 | 1 Froxlor | 1 Froxlor | 2026-10-29 | 7.5 High |
| Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, and the remembered-token lookup during login is not constrained to the customer or administrator account type. Because customer and administrator IDs are allocated from separate namespaces, a remembered-2FA token legitimately issued to a customer with a given ID also matches an administrator with the same ID. An attacker who controls a customer account with a colliding ID, holds a valid remembered-2FA cookie for it, and already knows the target administrator's password can bypass the administrator's TOTP second factor and obtain an authenticated administrator session. This is a second-factor bypass only; it does not defeat password authentication. Fixed in 2.3.11. | ||||
| CVE-2026-10031 | 2 Drakkan, Sftpgo Project | 2 Sftpgo, Sftpgo | 2026-10-29 | 5.4 Medium |
| SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions. | ||||
| CVE-2024-58394 | 1 Retool | 1 Retool | 2026-10-29 | 6.1 Medium |
| Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a Content Security Policy, executing JavaScript in victims' sessions. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-10-15. | ||||
| CVE-2024-58366 | 2 Delskayn, Surrealdb | 2 Rquickjs, Surrealdb | 2026-10-29 | 8.5 High |
| SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges. | ||||
| CVE-2024-58363 | 1 Surrealdb | 1 Surrealdb | 2026-10-29 | 6.3 Medium |
| SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter. | ||||
| CVE-2026-62018 | 2026-10-29 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | ||||
| CVE-2026-62008 | 2026-10-29 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | ||||
| CVE-2026-62002 | 2026-10-29 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | ||||
| CVE-2026-61995 | 2026-10-29 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions. | ||||
| CVE-2026-61988 | 2026-10-29 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions. | ||||
| CVE-2026-42692 | 2026-10-29 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. | ||||
| CVE-2026-25448 | 2026-10-29 | 4.3 Medium | ||
| Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.17.10. | ||||
| CVE-2026-118097 | 2026-10-29 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0. | ||||
| CVE-2026-118081 | 2026-10-29 | 8.8 High | ||
| Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions. | ||||
| CVE-2026-118076 | 2026-10-29 | 8.8 High | ||
| Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. | ||||