Export limit exceeded: 384618 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (384618 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82286 | 2026-08-28 | 8.6 High | ||
| gpt-crawler through 1.5.1 fails to validate the outputFileName parameter in the POST /crawl endpoint, allowing unauthenticated attackers to write arbitrary files to any filesystem path. Attackers can supply absolute paths or parent-directory segments to overwrite existing files with content sourced from attacker-controlled URLs. | ||||
| CVE-2026-82285 | 2026-08-28 | 8.2 High | ||
| bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names. | ||||
| CVE-2026-82282 | 1 Runatlantis | 1 Atlantis | 2026-08-28 | 8 High |
| Atlantis through 0.47.1 fails to authenticate the /github-app/setup endpoint, allowing unauthenticated attackers to access GitHub App credentials. Attackers can observe or intercept the GitHub redirect during setup to obtain the RSA private key and webhook secret, enabling installation token minting and webhook payload forgery. | ||||
| CVE-2026-82281 | 1 Cinnamon | 1 Kotaemon | 2026-08-28 | 7.4 High |
| Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation identifiers without proper authorization checks. | ||||
| CVE-2026-82280 | 1 Quivr | 1 Quivr | 2026-08-28 | 7.1 High |
| Quivr through 0.0.322 fails to validate ownership in prompt endpoints, allowing authenticated users to modify any prompt by identifier. Attackers with read-only access to shared brains can read exposed prompt identifiers and overwrite system prompts affecting all brain users. | ||||
| CVE-2026-82277 | 2026-08-28 | 9.8 Critical | ||
| Argo Rollouts dashboard through 1.10.0 binds to all interfaces and exposes mutating Rollout operations without authentication, authorization, or CSRF protection. Attackers on the same network can invoke PromoteRollout, AbortRollout, RestartRollout, SetRolloutImage, UndoRollout, and RetryRollout operations across all namespaces accessible to the operator's kubeconfig. | ||||
| CVE-2026-82276 | 2026-08-28 | 5.3 Medium | ||
| StarRocks through 4.0.13 contains an authentication bypass vulnerability in five REST handler classes that override execute() directly instead of implementing executeWithoutPassword(). Attackers can access six unauthenticated endpoints on the frontend HTTP port to disclose cluster topology, database metadata, JVM statistics, and version information without credentials. | ||||
| CVE-2026-82275 | 2026-08-28 | 7.5 High | ||
| Qwen-Agent through 0.0.34 contains a path traversal vulnerability in the document parser that fails to restrict file access to intended directories. Attackers can supply absolute file paths to the unauthenticated Gradio interface to read arbitrary files accessible by the server process. | ||||
| CVE-2026-82271 | 2026-08-28 | 6.5 Medium | ||
| R2R through 3.6.5 fails to properly validate user ownership in conversation update and message handlers, allowing authenticated users to modify other users' conversations. Attackers can supply arbitrary conversation identifiers to rename conversations and append messages to other users' conversation histories, corrupting state and injecting malicious content. | ||||
| CVE-2026-82267 | 2026-08-28 | 5.4 Medium | ||
| Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert fraudulent audit log entries misrepresenting privileged operations. | ||||
| CVE-2026-82266 | 1 Redpanda | 1 Redpanda | 2026-08-28 | 9.8 Critical |
| Redpanda through 26.2.2 binds the Admin API to 0.0.0.0:9644 with admin_api_require_auth defaulting to false, treating unauthenticated requests as superusers. Attackers can reach port 9644 without credentials to create and delete broker accounts, modify cluster configuration, and disrupt partition replication. | ||||
| CVE-2026-82265 | 2026-08-28 | 6.5 Medium | ||
| Zipkin through 3.6.1 exposes Spring Boot Actuator endpoints on the tracing API port without authentication, allowing unauthenticated attackers to access sensitive information. Attackers can read environment variables, bean configurations, and storage credentials via actuator endpoints, or modify log levels to suppress logging. | ||||
| CVE-2026-15798 | 2 Nextendweb, Wordpress | 2 Smart Slider 3, Wordpress | 2026-08-28 | 6.4 Medium |
| The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected scripts execute specifically when a user opens the affected post in the WordPress block editor, making Editors and Administrators the primary targets. | ||||
| CVE-2026-82247 | 1 Gitoxidelabs | 1 Gitoxide | 2026-08-28 | 7.5 High |
| gitoxide's gix-url crate (<= 0.32.0, fixed in 0.37.1) uses a hand-rolled URL parser that does not treat '?' or '#' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard (can_reuse_identity) compares the wrong host and fails open. An attacker controlling a redirect response can craft a Location header of the form <attacker-authority>?@<original-authority> so that gitoxide sends the caller's HTTP Basic Authorization credentials to an unintended host. gix-transport is affected in versions <= 0.49.0 (fixed in 0.58.1). | ||||
| CVE-2026-82222 | 2 Liquid Web / Stellarwp, Wordpress | 2 Givewp, Wordpress | 2026-08-28 | 10 Critical |
| Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP GiveWP allows Object Injection. This issue affects GiveWP: from n/a through 4.16.7.1. | ||||
| CVE-2026-82220 | 2026-08-28 | 5.3 Medium | ||
| Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions. | ||||
| CVE-2026-82082 | 1 Green-computing | 1 Numail | 2026-08-28 | 9.8 Critical |
| NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server. | ||||
| CVE-2026-78073 | 1 Mrvinoth.com | 1 All Video Share Extension For Joomla | 2026-08-28 | N/A |
| Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors | ||||
| CVE-2026-78072 | 1 Jefferson49 | 1 Sexy Polling Reloaded Extension For Joomla | 2026-08-28 | N/A |
| Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1 | ||||
| CVE-2026-75628 | 1 Punk | 1 Oauth2 | 2026-08-28 | 5.7 Medium |
| Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter. oauth2_login reads the return parameter from the initiation request, runs same_origin_path over it, and stores the survivor in the session flow record as the post-login redirect target. That check rejects a value that does not begin with a slash, one with a slash as its second byte, and one containing CR or LF. A backslash and a tab pass. The URL Standard treats a backslash as equivalent to a slash for special schemes, so `/\evil.example` parses with the authority `evil.example`. It also strips ASCII tab before parsing, so a tab between two leading slashes leaves `//evil.example`. A crafted link to the application's own login route lands the victim on the attacker's site after a genuine authentication. The redirect carries no authorization code or access token. | ||||