Export limit exceeded: 15644 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 11566 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 17570 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (17570 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-47382 | 1 Nocodb | 1 Nocodb | 2026-06-24 | N/A |
| NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the connection-test endpoint opened a raw TCP socket to the user-supplied database host without resolving and range-checking the destination, so private and link-local addresses (including IPv4-mapped IPv6 forms and localhost) reached the driver. This vulnerability is fixed in 2026.05.1. | ||||
| CVE-2026-54516 | 1 Fasterxml | 1 Jackson-databind | 2026-06-24 | 5.3 Medium |
| jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, POJOPropertiesCollector._renameProperties() allows a property with @JsonProperty("renamed") on the getter and @JsonIgnore on the setter to be renamed rather than dropped. With MapperFeature.INFER_PROPERTY_MUTATORS enabled (default), the private backing field is retained; during deserialization BeanDeserializerFactory.addBeanProps() sees hasField()==true, builds a FieldProperty, and makes the backing field writable. An attacker supplying the renamed JSON key writes the backing field directly, bypassing the @JsonIgnore on the setter. This vulnerability is fixed in 3.1.4. | ||||
| CVE-2026-53927 | 1 Nocodb | 1 Nocodb | 2026-06-24 | N/A |
| NocoDB is software for building databases as spreadsheets. Prior to 2026.05.1, the spreadsheet-fetch endpoint (axiosRequestMake) accepted URLs whose path contained a permitted extension anywhere in the string, and applied a hand-rolled regex blocklist that omitted 127.0.0.0/8 and 169.254.0.0/16, allowing the cloud-metadata endpoint to be reached with a crafted URL This vulnerability is fixed in 2026.05.1. | ||||
| CVE-2026-46548 | 1 Nocodb | 1 Nocodb | 2026-06-24 | 4.3 Medium |
| NocoDB is software for building databases as spreadsheets. Prior to 2026.04.1, the request-filtering-agent SSRF protection was non-functional in the four notification webhook plugins (Slack, Discord, Mattermost, Teams) because httpAgent / httpsAgent were passed as part of the request body rather than the axios config. An authenticated user with hook-creation permission could direct outbound POST requests to arbitrary internal hosts. This vulnerability is fixed in 2026.04.1. | ||||
| CVE-2026-54515 | 1 Fasterxml | 1 Jackson-databind | 2026-06-24 | 5.3 Medium |
| jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are applied by _handleByNameInclusion(), producing a contextual deserializer whose BeanPropertyMap has the ignored properties removed. The subsequent per-property case-insensitivity block (triggered by @JsonFormat(ACCEPT_CASE_INSENSITIVE_PROPERTIES)) rebuilds from this._beanProperties (the original, unfiltered map) instead of contextual._beanProperties, then overwrites the filtered map — restoring every property _handleByNameInclusion had just removed. The ignored property becomes writable again. This vulnerability is fixed in 2.18.9, 2.21.5, and 3.1.4. | ||||
| CVE-2026-44959 | 1 Revive | 1 Adserver | 2026-06-24 | N/A |
| A missing validation of user input exists when saving delivery limitations in Revive Adserver 6.0.6 and earlier. A low‑privileged user could add an unexpected component parameter and inject malicious PHP code into the compiledlimitations field, which would then be executed during banner delivery. Input sanitisation has been improved to ensure that unexpected parameters are filtered out. | ||||
| CVE-2026-34916 | 1 Revive-adserver | 1 Revive Adserver | 2026-06-24 | N/A |
| A missing validation of user input when saving delivery limitations in Revive Adserver 6.0.6 and earlier could allow a low‑privileged user to use the logical parameter to inject malicious PHP code into the compiledlimitations field on the database and have it executed during banner delivery. Input sanitisation has been improved to ensure that the parameter is properly validated. | ||||
| CVE-2026-50221 | 1 Openstack | 1 Swift | 2026-06-24 | 5.4 Medium |
| In OpenStack Swift before 2.37.2, proxy-server does not strip internal update headers (X-Container-Host, X-Container-Device, X-Delete-At-Host, X-Delete-At-Device) from client requests before forwarding them to object-servers. An authenticated user with write access can inject these headers to redirect container update requests to an attacker-controlled server, enabling server-side request forgery. The SSRF requests expose internal cluster metadata including storage policy indexes, partition mappings, device names, and when at rest encryption is enabled, cipher text and initialization vectors for the container-level encryption key. The attacker can also cause "ghost listings" in arbitrary containers via the shard-range redirect mechanism. | ||||
| CVE-2026-13150 | 1 Pentestify | 1 Pentestify | 2026-06-24 | N/A |
| Server-Side Request Forgery (SSRF) (CWE-918) in the PDF generation endpoint GET /api/reports/{id}/pdf (backend/main.py) in ccyl13 Pentestify 1.0.0 and lower allows remote attackers to make the server issue requests to arbitrary internal or external URLs, including cloud metadata services, and return the rendered content in the resulting PDF via a crafted Host header, because the target URL is built from request.base_url without validation. | ||||
| CVE-2026-54157 | 1 Lobehub | 1 Lobehub | 2026-06-23 | 9 Critical |
| LobeHub is a work-and-lifestyle space to find, build, and collaborate with agent teammates that grow with you. Prior to 2.1.57, the /webapi/proxy endpoint on app.lobehub.com accepts a URL in the POST body and fetches it server-side without any authentication. An attacker can use this to make arbitrary outbound requests from LobeHub's infrastructure, leak Vercel deployment details, and inject cookies on the lobehub.com domain through reflected Set-Cookie headers. This vulnerability is fixed in 2.1.57. | ||||
| CVE-2026-53754 | 2 Kidocode, Unclecode | 2 Crawl4ai, Crawl4ai | 2026-06-23 | 7.5 High |
| Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.8, the Docker API server's SSRF protection (validate_webhook_url / validate_url_destination in deploy/docker/utils.py) used an explicit IPv4/IPv6 CIDR blocklist that missed several address families. An attacker could reach internal services and cloud metadata endpoints (e.g. 169.254.169.254) despite the filter by encoding an internal IPv4 address inside an IPv6 transition form, or by using the IPv6 unspecified address. Because the Docker API is unauthenticated by default (jwt_enabled: false), no credentials are required. This vulnerability is fixed in 0.8.8. | ||||
| CVE-2026-53753 | 2 Kidocode, Unclecode | 2 Crawl4ai, Crawl4ai | 2026-06-23 | 9.8 Critical |
| Crawl4AI is an open-source LLM friendly web crawler & scraper. Prior to 0.8.7, the _safe_eval_expression() function in the computed fields feature uses an AST validator that only blocks attributes starting with underscore. Python generator and frame object attributes (gi_frame, f_back, f_builtins) do NOT start with underscore, enabling a complete sandbox escape to achieve arbitrary code execution. The attack requires no authentication (JWT disabled by default) and is triggered via POST /crawl with a crafted extraction schema. This vulnerability is fixed in 0.8.7. | ||||
| CVE-2025-60175 | 2 Vynnus, Wordpress | 2 Popad, Wordpress | 2026-06-23 | 4.4 Medium |
| Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions. | ||||
| CVE-2026-48836 | 2 Mantrabrain, Wordpress | 2 Easy Invoice, Wordpress | 2026-06-23 | 10 Critical |
| Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions. | ||||
| CVE-2026-49774 | 2 Filipe Nasc, Wordpress | 2 Rd Station, Wordpress | 2026-06-23 | 9.9 Critical |
| Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0. | ||||
| CVE-2025-58924 | 2 Themerex Group, Wordpress | 2 Geya, Wordpress | 2026-06-23 | 8.1 High |
| Unauthenticated Local File Inclusion in Geya <= 1.15 versions. | ||||
| CVE-2025-60085 | 2 Themerex Group, Wordpress | 2 Learnify, Wordpress | 2026-06-23 | 8.1 High |
| Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions. | ||||
| CVE-2025-69107 | 2 Themerex, Wordpress | 2 Rosaleen, Wordpress | 2026-06-23 | 8.1 High |
| Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions. | ||||
| CVE-2025-69109 | 2 Themerex, Wordpress | 2 Raider Spirit, Wordpress | 2026-06-23 | 8.1 High |
| Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions. | ||||
| CVE-2025-69119 | 2 Themerex, Wordpress | 2 Corbesier, Wordpress | 2026-06-23 | 8.1 High |
| Unauthenticated Local File Inclusion in Corbesier <= 1.15.0 versions. | ||||