Export limit exceeded: 106914 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (106914 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-71259 | 1 Esphome | 1 Esphome | 2026-08-10 | 8.6 High |
| ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to (git supports file:// natively). | ||||
| CVE-2026-71255 | 1 Debevv | 1 Nanomodbus | 2026-08-10 | 8.6 High |
| nanoMODBUS through v1.23.0 contains an out-of-bounds write in the Modbus client-side recv_read_device_identification_res function (FC 0x2B/MEI 0x0E, Read Device Identification) in nanomodbus.c. The server-supplied object_length field (0-246) is validated only against the remaining PDU size (res_size_left) and is never validated against the caller-supplied buffers_length parameter. | ||||
| CVE-2026-71252 | 1 Raghav993 | 1 Toner-management | 2026-08-10 | 8.2 High |
| toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories) executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforced only in listing views. | ||||
| CVE-2026-71243 | 1 Adaltas | 1 Backmeup | 2026-08-10 | 8.8 High |
| The backmeup npm package assembles shell command strings by directly concatenating its option values (name, source, destination, filter) - e.g. cmd = "mkdir -p " + path.join(info.destination, info.name) + "; " - and executes the resulting string through a shell via ssh2-exec (locally via child_process, or remotely via SSH when an ssh handle is supplied), rather than using execFile/spawn with an argument array. | ||||
| CVE-2026-71242 | 1 Crater-invoice-inc | 1 Crater | 2026-08-10 | 8.2 High |
| Crater's NotePolicy checks only a blanket Bouncer ability (manage-all-notes / view-all-notes) with no company-ownership comparison, unlike InvoicePolicy and other sibling policies which additionally verify ->hasCompany(->company_id). Any authenticated user of one company can read, edit, or delete another company's notes by ID. | ||||
| CVE-2026-71241 | 1 Lyric777 | 1 Book-management-system | 2026-08-10 | 7.5 High |
| Book-Management-System's Flask API endpoints /student, /record, /books, /find_stu_book, and /find_not_return_book are missing the @login_required decorator that protects sibling routes (/search_student, /storage) in the same file. Because card_id values are sequential integers, the entire student database can be enumerated without authentication. | ||||
| CVE-2026-71239 | 1 Djangocrm | 1 Django-crm | 2026-08-10 | 8.1 High |
| DjangoCRM's massmail module renders user-controlled EmlMessage fields (subject, content) through Django's Template constructor with no sanitization, in at least three locations: message_previews.py builds an f-string embedding message.subject/message.content directly into a Template call; email_creators.py passes eml_message.subject directly as a template string to Template; and helpers.py contains the same f-string interpolation pattern. | ||||
| CVE-2026-71236 | 1 Grocy | 1 Grocy | 2026-08-10 | 8.7 High |
| Grocy's API request-body parser (controllers/Api/BaseApiController.php, GetParsedAndFilteredRequestBody) purifies incoming field values with HTMLPurifier, then manually reverses HTML-entity encoding of the resulting output by replacing &lt;, &gt;, and &amp; back to <, >, and & immediately after purification. | ||||
| CVE-2026-71235 | 1 Absmach | 1 Magistrala | 2026-08-10 | 8.8 High |
| Magistrala's Rules Engine allows authenticated users to create rules with embedded Go or Lua scripts executed server-side when IoT messages arrive. The Lua script engine (re/lua.go) performs no input validation at all and preloads dangerous libraries: db (arbitrary database access), ioutil (file I/O), an HTTP client (SSRF), and filepath (traversal). | ||||
| CVE-2026-71234 | 1 Documize | 1 Community | 2026-08-10 | 7.5 High |
| Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value. | ||||
| CVE-2026-71233 | 1 Invoiceninja | 1 Invoice Ninja | 2026-08-10 | 8.7 High |
| InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive {!! ->terms !!} (resources/views/portal/ninja2020/invoices/includes/terms.blade.php) with no HTML sanitization. | ||||
| CVE-2026-71232 | 1 Magicblack | 1 Maccms | 2026-08-10 | 7.2 High |
| MacCMS10's admin template editor (application/admin/controller/Template.php) blocks dangerous PHP functions in template content via a blacklist regex, but the blacklist omitted exec, passthru, popen, show_source, create_function, register_shutdown_function, register_tick_function, and error_log. | ||||
| CVE-2026-71215 | 1 Art-template | 1 Art-template | 2026-08-10 | 7.5 High |
| art-template's sub-template resolution logic (src/compile/adapter/resolve-filename.js), used by both the include and extend template directives, resolves the target file path via path.resolve(root, filename) with no check afterward that the result remains inside root. | ||||
| CVE-2026-71211 | 1 Mlflow | 1 Mlflow | 2026-08-10 | 7.1 High |
| MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/server/gateway_api.py, raw_proxy) subsequently issues an HTTP request to that stored api_base plus a caller-supplied path and returns the full response body. | ||||
| CVE-2026-71209 | 1 Advplyr | 1 Audiobookshelf | 2026-08-10 | 7.5 High |
| audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-allowed GET routes against req.path via a regex requiring a literal /items/:id/cover or /authors/:id/image shape, where req.path retains %2F sequences URL-encoded. CacheManager.handleCoverCache then joins this decoded value into a cache file path and streams the result before any database-backed ownership check. | ||||
| CVE-2026-71206 | 1 Go-shiori | 1 Shiori | 2026-08-10 | 8.2 High |
| Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists in the codebase. | ||||
| CVE-2026-71202 | 1 Kosinix | 1 Raster | 2026-08-10 | 7.5 High |
| The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height. | ||||
| CVE-2026-70378 | 1 Theotherphil | 1 Imagecli | 2026-08-10 | 7.5 High |
| imagecli's pipeline operation (Carve::apply in src/image_ops.rs) only asserts , never validating that the ratio is positive. A negative ratio (e.g. -5) causes the computed target width to saturate to 0 via Rust's defined float-to-uint cast, which is then passed to imageproc::seam_carving::shrink_width — a function that panics when given a width below 2, crashing the process. | ||||
| CVE-2026-70377 | 1 Theotherphil | 1 Imagecli | 2026-08-10 | 7.5 High |
| imagecli's pipeline operation (Scale::apply in src/image_ops.rs) computes output width/height as (dimension as f32 * ratio) as u32 with no upper-bound validation on the CLI-supplied ratio, which is parsed via nom::number::complete::float with no range check. Any application embedding imagecli as a library and accepting user-controlled pipeline strings is remotely crashable with a single request. | ||||
| CVE-2026-70375 | 1 Hashbrowncms | 1 Hashbrown Cms | 2026-08-10 | 8.8 High |
| HashBrown CMS through 1.4.6 contains an OS Command Injection vulnerability (CWE-78) in the Git deployer component. GitDeployer.pullRepo in src/Server/Entity/Deployer/GitDeployer.js executes AppService.exec, interpolating the configured branch value directly into a shell command with no escaping. | ||||