Export limit exceeded: 417349 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417349 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119717 | 2026-10-30 | 8.1 High | ||
| pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the generated resolve() string literal and execute code in the application process. | ||||
| CVE-2026-119716 | 2026-10-30 | 8.1 High | ||
| pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process. | ||||
| CVE-2026-119715 | 1 Nocodb | 1 Nocodb | 2026-10-30 | 4.3 Medium |
| NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated interface because no X-Frame-Options or CSP frame-ancestors headers are sent. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators. | ||||
| CVE-2026-119713 | 1 Paperclip | 1 Paperclipai\/server | 2026-10-30 | 8.8 High |
| Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host. | ||||
| CVE-2026-119711 | 1 Pipeshub | 1 Pipeshub | 2026-10-30 | 5.3 Medium |
| PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding. | ||||
| CVE-2026-119709 | 2026-10-30 | 5.8 Medium | ||
| Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata endpoints and read the parsed title, description, and page content returned. | ||||
| CVE-2026-119708 | 2026-10-30 | 6.5 Medium | ||
| abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement download-by-name endpoint, letting authenticated users read other tenants' files. Attackers supply a victim tenantId in the request path, causing DownloadByNameAsync to switch tenant context and return blobs stored by that tenant. | ||||
| CVE-2026-119707 | 1 Sonicjs | 1 Sonicjs | 2026-10-30 | 7.1 High |
| SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modify, publish, or soft-delete other users' documents, bypassing document ACLs and administrator deny overrides. | ||||
| CVE-2026-119705 | 2026-10-30 | 5.3 Medium | ||
| SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote unauthenticated attackers to trigger notification emails because verifyUser() is never called. Attackers can repeatedly POST to /api/notify, optionally with a domain parameter, to exhaust SMTP rate limits, trigger provider abuse flags and flood recipients. | ||||
| CVE-2026-119704 | 2026-10-30 | 6.8 Medium | ||
| Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that allows jailed users to escape jail isolation. Attackers inside a jail can plant symlinks pointing to host paths or other jail roots, so administrator-run copies overwrite or read host files with root privileges. | ||||
| CVE-2026-104066 | 2026-10-30 | 7.8 High | ||
| Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when unpacking 4-bit indexed pixel data. Attackers can supply a crafted PICT file with inconsistent width and row data that, when placed or imported, writes out of bounds, causing crashes or code execution. | ||||
| CVE-2026-104065 | 2026-10-30 | 7.8 High | ||
| Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an unvalidated y offset to select image scanlines. Attackers can craft a DRW file that, when imported by a user, writes decoded bitmap data outside the heap image buffer, causing crashes or code execution. | ||||
| CVE-2026-104064 | 2026-10-30 | 7.8 High | ||
| Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows attackers to trigger a heap overflow via crafted tile dimensions. Attackers can supply a tiled TIFF with large tile width, height and sample values for a user to import, corrupting heap memory to crash Scribus or execute code. | ||||
| CVE-2026-104062 | 2026-10-30 | 7.8 High | ||
| Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that allows attackers to corrupt heap memory by supplying an unchecked bytesPerLine value. Attackers can craft a PICT file whose bytesPerLine exceeds the QImage scanline size, so placing or importing it crashes Scribus and may execute code as the user. | ||||
| CVE-2026-104061 | 2026-10-30 | 7.8 High | ||
| Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses unchecked PSD file values as lookup array indexes. Attackers can convince users to place or import a crafted PSD file to corrupt heap memory, causing crashes and potentially code execution as the user. | ||||
| CVE-2026-97854 | 2026-10-30 | 9.8 Critical | ||
| Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product. | ||||
| CVE-2026-119575 | 1 Arcadedata | 1 Arcadedb | 2026-10-30 | 6.5 Medium |
| ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabaseSettings to disable the LOAD CSV IP block list via ALTER DATABASE. Attackers can set arcadedb.opencypher.loadCsv.blockedIpRanges to an empty string, then issue LOAD CSV requests to read cloud metadata and internal loopback or private services. | ||||
| CVE-2026-119576 | 1 Arcadedata | 1 Arcadedb | 2026-10-30 | 4.3 Medium |
| ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition with a crafted @sql directive to /api/v1/query/{database}, altering query results returned to other users including administrators. | ||||
| CVE-2026-91915 | 1 Dell | 1 Openmanage Enterprise | 2026-10-30 | 6.8 Medium |
| Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Script injection. | ||||
| CVE-2026-115706 | 1 Elastic | 1 Elastic Cloud Enterprise | 2026-10-30 | 6.8 Medium |
| Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages. | ||||