Export limit exceeded: 20903 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 401033 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 102036 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (102036 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82869 | 1 Tooljet | 1 Tooljet | 2026-08-31 | 7.7 High |
| ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by supplying victim workspace identifiers in the request path while authenticating with their own workspace credentials. | ||||
| CVE-2026-82659 | 1 Nodemailer | 1 Nodemailer | 2026-08-31 | 7.1 High |
| nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients. | ||||
| CVE-2026-82472 | 1 Documenso | 1 Documenso | 2026-08-31 | 7.5 High |
| Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records. | ||||
| CVE-2026-82466 | 1 Jeremyevans | 1 Rodauth | 2026-08-31 | 8.7 High |
| Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users. | ||||
| CVE-2026-82461 | 1 Pac4j | 1 Pac4j | 2026-08-31 | 8.1 High |
| pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation. | ||||
| CVE-2026-82453 | 1 Iot-ecology | 1 Rust-iot-platform | 2026-08-31 | 7.5 High |
| rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts. | ||||
| CVE-2026-82450 | 1 Bookstackapp | 1 Bookstack | 2026-08-31 | 8.8 High |
| BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests. | ||||
| CVE-2026-82291 | 1 Heyform | 1 Heyform | 2026-08-31 | 8.1 High |
| HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings. | ||||
| CVE-2026-82287 | 1 Rybbit-io | 1 Rybbit | 2026-08-31 | 8.1 High |
| Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website to read analytics data, account information, and perform authenticated state-changing operations as the victim user. | ||||
| CVE-2026-82285 | 1 Dataelement | 1 Bisheng | 2026-08-31 | 8.2 High |
| bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names. | ||||
| CVE-2026-82282 | 1 Runatlantis | 1 Atlantis | 2026-08-31 | 8 High |
| Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery. | ||||
| CVE-2026-82280 | 1 Quivr | 1 Quivr | 2026-08-31 | 7.1 High |
| Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users. | ||||
| CVE-2026-82275 | 1 Qwenlm | 1 Qwen-agent | 2026-08-31 | 7.5 High |
| Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary files accessible by the server process. | ||||
| CVE-2026-82270 | 1 Portkey-ai | 1 Gateway | 2026-08-31 | 7.5 High |
| Portkey AI Gateway through 1.15.2 contains a server-side request forgery vulnerability in the /v1/proxy/* route that lacks requestValidator middleware. Attackers can set the x-portkey-custom-host header to internal addresses and forward requests with Authorization headers to reach internal services and exfiltrate provider API keys. | ||||
| CVE-2026-82253 | 1 Gitoxidelabs | 1 Gitoxide | 2026-08-31 | 7.5 High |
| gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository's git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1. | ||||
| CVE-2026-82243 | 1 Budibase | 2 Budibase, Server | 2026-08-31 | 7.6 High |
| Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to attacker-controlled servers, gaining full database access in cloud deployments. | ||||
| CVE-2026-82021 | 1 Nousresearch | 1 Hermes-agent | 2026-08-31 | 8.3 High |
| Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromises the upstream repository can propagate malicious code to every host that installs the affected catalog entry, with no further action required by the operator. | ||||
| CVE-2026-55584 | 1 Phpsysinfo | 1 Phpsysinfo | 2026-08-31 | 7.5 High |
| phpSysInfo is a customizable PHP script that displays system information. Prior to 3.4.6, the PSI_ALLOWED access-control check in read_config.php trusts attacker-controlled X-Forwarded-For and Client-IP HTTP headers before REMOTE_ADDR. A remote unauthenticated attacker can supply an allowed address in one of these headers to impersonate a trusted client and access exposed hostname, kernel, CPU, memory, filesystem, and network-interface information. This issue is fixed in version 3.4.6. | ||||
| CVE-2026-55552 | 1 Yamcs | 1 Yamcs | 2026-08-31 | 7.5 High |
| Yamcs is a mission control framework. Prior to 5.11.13, Yamcs StaticFileHandler.locateFile resolves an unauthenticated request path without using Path.normalize and Path.toAbsolutePath to confirm that the absolute path remains within the configured staticRoots. A path containing traversal segments can escape the intended web root and return an arbitrary readable host file. The flaw is in yamcs-core/src/main/java/org/yamcs/http/StaticFileHandler.java and can disclose sensitive operating-system and application data. This issue is fixed in version 5.11.13, and the 5.12 line is fixed from version 5.12.0. | ||||
| CVE-2026-55066 | 1 Go-vikunja | 1 Vikunja | 2026-08-31 | 7.1 High |
| Vikunja is an open-source self-hosted task management platform. Prior to 2.4.0, POST /api/v1/projects/{project}/views/{view}/buckets/{bucket}/tasks accepts a body supplied task_id but TaskBucket.CanUpdate in pkg/models/kanban_task_bucket.go authorizes only the project, view, and bucket from the URL. updateTaskBucket then calls Task.ReadOne without a separate task permission check, returns the victim task contents, and can update the task done state when the attacker chooses a done bucket. Because task identifiers are global sequential values, an authenticated user can enumerate cross-tenant tasks and modify their completion metadata through both the v1 and v2 routes that share this model. This issue is fixed in version 2.4.0. | ||||