Export limit exceeded: 15876 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15876 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109204 | 1 Logicaldoc | 1 Logicaldoc | 2026-10-18 | 6.3 Medium |
| LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses. | ||||
| CVE-2026-108864 | 1 Iflytek | 1 Astron-agent | 2026-10-18 | 4.2 Medium |
| iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume content into victim workflows and read their continuation output stream, breaking cross-tenant isolation. | ||||
| CVE-2026-108854 | 1 Unicomai | 1 Wanwu | 2026-10-18 | 5.4 Medium |
| Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across organizations, breaking MCP and OpenAPI clients until owners issue new keys. | ||||
| CVE-2026-108689 | 1 Wukongopensource | 1 Wukong Aicrm | 2026-10-18 | 5.4 Medium |
| Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content. | ||||
| CVE-2026-108672 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-18 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video generation history, including prompts, task ids, video URLs and cover URLs. | ||||
| CVE-2026-108642 | 1 Jeecg | 2 Jeecg-boot, Jeecg Boot | 2026-10-18 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient ids, or linked announcements to hide messages from recipients. | ||||
| CVE-2026-108607 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-18 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked GET /airag/video/listByUser endpoint and delete victims' Redis-stored video history entries one record per request. | ||||
| CVE-2026-108596 | 1 Openlit | 1 Openlit | 2026-10-18 | 5.3 Medium |
| OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace read API to obtain traces including LLM prompts and completions. | ||||
| CVE-2026-108547 | 1 Iflytek | 1 Astron-rpa | 2026-10-18 | 6.5 Medium |
| AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext. | ||||
| CVE-2026-83646 | 1 Microsoft | 9 Windows 10 1607, Windows 10 1809, Windows Server 2016 and 6 more | 2026-10-18 | 4.8 Medium |
| Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-70185 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-18 | 8.8 High |
| Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-63163 | 1 Omnispace | 1 Agora Project | 2026-10-17 | 7.5 High |
| Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download arbitrary files by computing an md5(filename) token instead of passing a proper authorization check. Attackers can guess or determine file names to generate the corresponding md5 token and retrieve protected files without authorization, leading to unauthorized information disclosure. | ||||
| CVE-2026-59963 | 1 Tandoorrecipes | 1 Recipes | 2026-10-17 | 7.1 High |
| Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies another member's private recipe identifier to AI import, file, external-link, or share-link endpoints. Request processing uses api/ai-import/, api/get_recipe_file/, api/get_external_file_link/, api/share-link/, CustomRecipePermission. The attack works because the endpoints read private recipe files, send file bytes to the configured AI provider, or create and disclose external links without object-level authorization, and api/share-link/ can create a public link when Space sharing is enabled. This can expose private recipe files and sensitive uploaded content to another same-Space user and to configured external services. This issue is fixed in version 2.6.10. | ||||
| CVE-2026-61726 | 1 Tandoorrecipes | 1 Recipes | 2026-10-17 | 8.1 High |
| Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated user with read and write API scope in the victim's Space supplies a private recipe or step identifier to the Step API. Request processing uses StepViewSet, IngredientViewSet, api/step/, api/step/{step_id}/, CustomIsUser, CustomRecipePermission. The attack works because the sub-resource querysets return and update private-recipe steps for non-owners because Space membership is accepted without recipe-level authorization. This can read and silently modify another same-Space member's private recipe instructions, while cross-Space access remains out of scope. This issue is fixed in version 2.6.12. | ||||
| CVE-2026-66874 | 1 Gitea | 1 Gitea | 2026-10-17 | 6.5 Medium |
| For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from running. Because skipped statuses count as success, branch protection or organization-required workflow checks can appear satisfied without the mandated workflow executing; no runner or maintainer approval is required for this path. | ||||
| CVE-2026-68908 | 1 Mz-automation | 1 Libiec61850 | 2026-10-17 | 5.3 Medium |
| libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the report-control-block write path. When GI later causes sendNextReportEntrySegment to serialize the report, the function wraps rptIdBuf[130] as a temporary MmsValue and passes it to MmsValue_setVisibleString. The setter's resize path frees the stack-backed buffer, allowing a remote client to trigger an invalid free and server crash by writing the oversized RptID and then generating a report. This issue is fixed in version 1.6.2. | ||||
| CVE-2026-68907 | 1 Mz-automation | 1 Libiec61850 | 2026-10-17 | N/A |
| libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, checkDataSetAccess reverses the source and destination arguments to StringUtils_copyStringToBuffer while constructing an MMS_ASSOCIATION_SPECIFIC dataset reference. The helper treats uninitialized dataSetRef[130] storage as a source string, causing strlen to read beyond the stack buffer, and then copies those bytes into the caller-owned listName buffer. A remote defineNamedVariableList request can crash servers that have dynamic dataset service enabled and a dataset access handler installed; the advisory also observes caller stack corruption but establishes denial of service as the primary impact. This issue is fixed in version 1.6.2. | ||||
| CVE-2024-58398 | 1 Coder | 1 Coder | 2026-10-17 | 4.3 Medium |
| Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because the redirect query parameter is improperly sanitized. Attackers can craft a Coder login URL that, when clicked by a logged-in user, redirects the victim to an attacker-controlled website for phishing. | ||||
| CVE-2026-58395 | 1 Opnsense | 1 Core | 2026-10-17 | 4.3 Medium |
| OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the safe-delete path reached through ApiMutableModelControllerBase::delBase() interpolates an unvalidated safe-delete token from the request URL into an XPath expression over config.xml before confirming that the token is a valid identifier. A user holding any one affected module privilege can send a crafted token to one of 21 affected delete endpoints covering Traffic Shaper, DHCP relay, Dnsmasq, Firewall Category, or Kea DHCP, causing the XPath to match configuration data across modules. The resulting error response exposes configuration item names, descriptions, reference paths, and UUIDs and provides an XPath substring-presence oracle, including for modules the user cannot otherwise access. The request does not modify configuration or perform a deletion. This issue is fixed in version 26.1.11. | ||||
| CVE-2026-63159 | 1 Omnispace | 1 Agora Project | 2026-10-17 | 7.4 High |
| Omnispace Agora Project before 26.10.0 contains a predictable password-reset token vulnerability that allows unauthenticated attackers to take over user accounts by computing the reset token as sha1(login.password), a deterministic and reusable value. Attackers can derive or brute-force the reset token from known or guessed login and password combinations to forge valid password-reset requests and hijack arbitrary accounts. | ||||