Export limit exceeded: 409261 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 409261 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409261 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-111676 | 1 Ladybirdweb | 1 Faveo Helpdesk | 2026-10-16 | 4.3 Medium |
| Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other departments via the getTooltip handler. Attackers can enumerate sequential ticketid values on GET /ticket/tooltip to read ticket conversations, including customer personal data and internal agent notes. | ||||
| CVE-2026-111675 | 2026-10-16 | 7.4 High | ||
| Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts. | ||||
| CVE-2026-111674 | 2026-10-16 | 4.3 Medium | ||
| Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images through the /admin/setImgFileName endpoint. Attackers can supply a victim's imgname, exposed in public image URLs and album listings, to overwrite display names with attacker-chosen text attributed to the victim. | ||||
| CVE-2026-111672 | 2026-10-16 | 4.3 Medium | ||
| Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipeline ids via the web, log, monitoring, pod, and copy_pipeline endpoints to expose DAGs, cluster names, namespaces, Argo workflow ids, and pod names, or clone pipelines. | ||||
| CVE-2026-111671 | 2026-10-16 | 7.1 High | ||
| Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, clear or redeploy other users' notebooks and services by id. Attackers can pass sequential ids to lifecycle endpoints in view_notebook.py, view_inferenceserving.py and view_serving.py to delete pods and take production inference endpoints offline. | ||||
| CVE-2026-111670 | 2026-10-16 | 4.3 Medium | ||
| ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privileged users to access ClickHouse instances they were not granted. Attackers can iterate the instance-id parameter in ReportSourceDatabases, ReportSourceTables, ReportTableColumns and WhereCheckRun to enumerate schemas and infer row counts of restricted tables. | ||||
| CVE-2026-111669 | 2026-10-16 | 6.5 Medium | ||
| ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by supplying a crafted PagerInfo.Sort query parameter to the shared ToPage paging helper. Attackers holding the system:user:list permission can inject subquery or CASE expressions via GET /system/user/list to extract database contents such as stored credentials through blind techniques. | ||||
| CVE-2026-111668 | 2026-10-16 | 5.4 Medium | ||
| AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged users to bypass efficiency:read and efficiency:write permission checks. Attackers can query routes like /cost/detail, /top-users and /budget to read organization-wide AI spend, and can modify suggestion statuses or generate reports. | ||||
| CVE-2026-111667 | 1 Getrebuild | 1 Rebuild | 2026-10-16 | 4.3 Medium |
| REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id of a task in a private project to the /project/comments/list endpoint to retrieve its comment content and attachment references. | ||||
| CVE-2026-111666 | 1 Steedos | 1 Steedos-platform | 2026-10-16 | 4.3 Medium |
| Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants' report definitions by querying the reports object. Because objectql's callAdapter skips space filtering for enable_space_global objects on find/findOne, attackers can call GET /api/v1/reports to disclose report names, descriptions, and object and field API names. | ||||
| CVE-2026-111665 | 1 Dotnetfoundation | 1 Piranha Cms | 2026-10-16 | 5.4 Medium |
| Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authenticated manager user to list, create, edit and delete site languages without the granular Language, LanguageAdd, LanguageEdit or LanguageDelete permissions. Attackers can call the manager/api/language Get, Save and Delete actions directly to remove languages and reassign sites to the default, affecting localized content instance-wide. | ||||
| CVE-2026-111664 | 2026-10-16 | 4.4 Medium | ||
| Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by calling the POST /api/v1/updates/from-url endpoint registered with api.PermitAnyone. Attackers can supply an attacker-controlled index URL that bypasses version checks and auto-apply settings, installing older Safing-signed releases carrying previously fixed vulnerabilities. | ||||
| CVE-2026-111663 | 2026-10-16 | 8.6 High | ||
| Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL. | ||||
| CVE-2026-70074 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-10-16 | 5.5 Medium |
| Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-111661 | 2026-10-16 | 5.3 Medium | ||
| waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by calling the anonymously mapped /callback/email endpoint. Attackers can POST caller-supplied subject, content, and recipient to EmailController.sendEmail, sending messages from the operator's SMTP account for phishing, spam, and mail quota exhaustion. | ||||
| CVE-2026-111660 | 2026-10-16 | 6.5 Medium | ||
| waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels. | ||||
| CVE-2026-111659 | 2026-10-16 | 6.5 Medium | ||
| Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock. | ||||
| CVE-2026-111658 | 1 Sscms | 1 Sscms | 2026-10-16 | 3.8 Low |
| SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators to access other sites' channels by supplying foreign channel IDs. Attackers with Channels permission on one site can read and overwrite another site's channel names, file paths, templates, link URLs, and custom fields, breaking multi-site isolation. | ||||
| CVE-2026-111656 | 2026-10-16 | 5.4 Medium | ||
| ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's form filters by supplying arbitrary form_id values. Attackers can send sequential form_id values to getFormFilterList, getFormFilterInfo and updateFormFilterSort to read filter rules and overwrite another tenant's filter sort order. | ||||
| CVE-2026-111655 | 2026-10-16 | 3.8 Low | ||
| ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators to read and overwrite other administrators' file records via admin/file.edit. Attackers holding the admin/file.edit node can request or POST a target id with columns like xurl, hash, or uuid to view download URLs, tamper records, or reassign ownership. | ||||