Export limit exceeded: 10135 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10135 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108754 | 2026-10-11 | 3.3 Low | ||
| GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys because the Gin Logger middleware records the raw query string before extractAuthKey strips the key parameter. Attackers with read access to console logs or ./data/logs/app.log can recover proxy keys from Gemini-style requests and use them against the corresponding group. | ||||
| CVE-2026-108751 | 2026-10-11 | 4.4 Medium | ||
| MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template deployer that allows malicious repositories to overwrite files outside the project via a symlinked .moai-tmp staging path. Attackers can commit a symlink such as .claude/settings.json.moai-tmp so atomicWriteFile truncates and overwrites victim-writable files with MoAI template content. | ||||
| CVE-2026-108723 | 2026-10-11 | 2.5 Low | ||
| answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block src= embedding, where localPath() checks only path text without resolving symlinks. Attackers can ship a repository with a symlink pointing outside the checkout so am render embeds readable external files into generated HTML, disclosing them when shared. | ||||
| CVE-2026-81797 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. | ||||
| CVE-2026-78535 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions. | ||||
| CVE-2026-78533 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions. | ||||
| CVE-2026-78531 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions. | ||||
| CVE-2026-78529 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Alliance <= 3.11 versions. | ||||
| CVE-2026-66569 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions. | ||||
| CVE-2026-66568 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. | ||||
| CVE-2026-66567 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions. | ||||
| CVE-2026-66565 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. | ||||
| CVE-2026-66564 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. | ||||
| CVE-2026-66563 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. | ||||
| CVE-2026-66483 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. | ||||
| CVE-2026-66482 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. | ||||
| CVE-2026-62125 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. | ||||
| CVE-2026-62124 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions. | ||||
| CVE-2026-62123 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. | ||||
| CVE-2026-62120 | 2026-10-11 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Law Office <= 3.20 versions. | ||||