Export limit exceeded: 417953 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417953 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109667 | 1 Frappe | 1 Erpnext | 2026-10-14 | 8.8 High |
| Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that takes the record type from the request and inserts the record with permission checks disabled. Any authenticated user, including one holding no operational role, can supply a privileged record type to create privileged accounts and take full control of the site. | ||||
| CVE-2026-109662 | 1 Frappe | 1 Erpnext | 2026-10-14 | 6.1 Medium |
| Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that accepts unauthenticated submissions and stores content later rendered with insufficient neutralisation. Unauthenticated attackers can submit crafted markup that executes in the browser sessions of staff who review the stored record. | ||||
| CVE-2026-109657 | 1 Frappe | 1 Erpnext | 2026-10-14 | 5.4 Medium |
| Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script through a record name rendered without escaping. Attackers can set a malicious record name so the script runs in the browser of any colleague who opens the page. | ||||
| CVE-2026-109652 | 1 Frappe | 1 Erpnext | 2026-10-14 | 8.8 High |
| Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled message fields are not validated before template rendering, allowing expressions to run in an unrestricted context. Authenticated attackers holding a common operational role can inject template expressions to read and write arbitrary database data, delete documents, send outbound requests from the server, and send mail from the site. | ||||
| CVE-2026-109647 | 1 Frappe | 1 Erpnext | 2026-10-14 | 6.5 Medium |
| Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input validation. Authenticated attackers can send specially crafted requests to these endpoints to manipulate database queries and extract sensitive information from the ERPNext database. | ||||
| CVE-2026-109642 | 1 Frappe | 1 Erpnext | 2026-10-14 | 4.3 Medium |
| Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can query these endpoints to read data beyond what their assigned role permits. | ||||
| CVE-2026-109637 | 1 Frappe | 1 Erpnext | 2026-10-14 | 6.5 Medium |
| Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to master data records. | ||||
| CVE-2026-109632 | 1 Frappe | 1 Erpnext | 2026-10-14 | 6.5 Medium |
| Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role permits. | ||||
| CVE-2026-109627 | 1 Frappe | 1 Erpnext | 2026-10-14 | 6.5 Medium |
| Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what their assigned role permits. | ||||
| CVE-2026-109622 | 1 Frappe | 1 Erpnext | 2026-10-14 | 4.3 Medium |
| Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can send requests to the affected endpoints to modify data beyond their permitted role, compromising data integrity. | ||||
| CVE-2026-109609 | 1 Frappe | 1 Erpnext | 2026-10-14 | 6.5 Medium |
| Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation. Authenticated attackers with low privileges can send specially crafted requests to these endpoints to inject SQL and extract sensitive information from the ERPNext database. | ||||
| CVE-2026-109601 | 1 Frappe | 1 Frappe | 2026-10-14 | 6.5 Medium |
| Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outgoing email HTML. Attackers who can supply outgoing email content can set an attribute value referencing a local file path to expose sensitive server files. | ||||
| CVE-2026-108940 | 1 Ericlbuehler | 1 Mistral.rs | 2026-10-14 | 6.5 Medium |
| A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration_apply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument save_cimatrix results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.9.4 is sufficient to fix this issue. The patch is named 8c81056712709b4845ec6d9531e4d35bab4a367c. It is suggested to upgrade the affected component. | ||||
| CVE-2026-108936 | 1 Edimax | 2 Br-6208ac, Br-6208ac Firmware | 2026-10-14 | 2.4 Low |
| A security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formQoS of the component QoS Page. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-71432 | 1 Frappe | 1 Erpnext | 2026-10-14 | 8.1 High |
| Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted URL to run injected script and take over the victim's account. | ||||
| CVE-2026-107426 | 2026-10-14 | 7.3 High | ||
| Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12. | ||||
| CVE-2026-70219 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-10-14 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-88154 | 1 Microsoft | 5 365 Apps, Microsoft 365, Office 2021 and 2 more | 2026-10-14 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-76264 | 1 Splunk | 2 Splunk, Splunk Enterprise | 2026-10-14 | 4.3 Medium |
| In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could create or edit scripted lookup definitions through raw configuration endpoints. The vulnerability is possible because raw transforms configuration write paths do not apply external lookup capability checks before saving scripted lookup settings. | ||||
| CVE-2026-62040 | 2026-10-14 | 5.3 Medium | ||
| Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force restrict-user-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through 2.8.1. | ||||