Export limit exceeded: 414022 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 15869 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15869 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112034 | 1 Aircheng-org | 1 Iwebshop-5 | 2026-10-19 | 4.3 Medium |
| A weakness has been identified in aircheng-org iWebShop-5 up to 5.16. The impacted element is the function IController::redirect of the file plugins/_userInfo/_userInfo.php of the component Login Redirect. This manipulation of the argument callback causes open redirect. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-92715 | 2 Themeum, Wordpress-extensions | 2 Tutor Lms – Elearning And Online Course Solution, Tutor Lms | 2026-10-18 | 4.3 Medium |
| The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the 'ID' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with author-level access and above, to modify arbitrary courses created by other instructors — overwriting their title, content, and status — and reassign ownership of those courses to themselves. This is possible because Input::sanitize_array() preserves attacker-supplied POST keys (including 'ID') without stripping them, and WordPress interprets a non-empty ID in the wp_insert_post() argument array as an update to the existing post rather than a new insert. | ||||
| CVE-2026-88794 | 1 Sparxsystems | 1 Enterprise Architect | 2026-10-18 | N/A |
| Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions. | ||||
| CVE-2026-78433 | 1 Gitea | 1 Gitea | 2026-10-18 | 5.9 Medium |
| Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker. | ||||
| CVE-2026-110070 | 2026-10-18 | 6.5 Medium | ||
| The Modern Events Calendar Lite WordPress plugin before 7.36.4 does not verify that a user is authorized to edit the target post before updating it, allowing authenticated users with the Subscriber role to modify the title, content, and excerpt of arbitrary posts, pages, and custom post types created by other users. | ||||
| CVE-2026-74037 | 1 Wazuh | 2 Wazuh, Wazuh-manager | 2026-10-18 | 7.2 High |
| Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the blacklist. Attackers with revoked administrator grants can continue authenticating and self-link the administrator role to permanently retain privileged access. | ||||
| CVE-2026-109675 | 1 Frappe | 1 Suite | 2026-10-18 | 4.3 Medium |
| Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names, message counts, automation rules with sender addresses, and storage quota usage. | ||||
| CVE-2026-108879 | 1 Jeecg | 2 Jeecg-boot, Jeecg Boot | 2026-10-18 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users to read other users' AI chat variables via the username parameter. Attackers can send POST requests to /airag/api/getChatVariable with a target appId, username, and variable name to retrieve stored chat memory values from Redis. | ||||
| CVE-2026-111931 | 1 Coder | 1 Coder | 2026-10-18 | 4.3 Medium |
| Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers to redirect users externally via unsanitized r.URL.Path values. Attackers can craft links on trusted workspace app subdomains with paths beginning with double slashes, which become scheme-relative redirects to attacker sites for phishing. | ||||
| CVE-2026-110383 | 2026-10-18 | 7.5 High | ||
| Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-fluent-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electronic Signature Add-on for Fluent Forms: from n/a through 2.0.5. | ||||
| CVE-2026-109946 | 1 Freerdp | 1 Freerdp | 2026-10-18 | 6.5 Medium |
| FreeRDP 3.11.0 before 3.32.0 does not validate that AVC444 and AVC444v2 region widths are even before YUV444 conversion, so an odd width reaches an assertion and aborts the client. A malicious or compromised RDP server can terminate a connected FreeRDP client after RDPGFX AVC444 negotiation by sending an in-bounds region rectangle with an odd width. | ||||
| CVE-2026-109393 | 1 Webkul | 1 Qloapps | 2026-10-18 | 6.3 Medium |
| QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, AdminBookingDocumentController, AdminProductsController and AdminAddHotelController that skip htl_access hotel checks. Hotel-restricted employees can supply other hotels' sequential identifiers to read, upload and delete booking documents and delete rooms, room images and hotel images. | ||||
| CVE-2026-109204 | 1 Logicaldoc | 1 Logicaldoc | 2026-10-18 | 6.3 Medium |
| LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind password recovery tickets to the requesting user. Attackers can obtain a ticket for their own account and reuse it with any userId, including administrators, to reset victims' passwords, lock them out, and reveal their email addresses. | ||||
| CVE-2026-108864 | 1 Iflytek | 1 Astron-agent | 2026-10-18 | 4.2 Medium |
| iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resume other applications' paused workflows by supplying their event_id to POST /workflow/v1/resume. Attackers can predict Snowflake event IDs to inject resume content into victim workflows and read their continuation output stream, breaking cross-tenant isolation. | ||||
| CVE-2026-108854 | 1 Unicomai | 1 Wanwu | 2026-10-18 | 5.4 Medium |
| Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authenticated enabled user to delete other users' legacy AppKeys by supplying a numeric apiId. Attackers can iterate sequential key IDs against DELETE /v1/appspace/app/key to revoke AppKeys across organizations, breaking MCP and OpenAPI clients until owners issue new keys. | ||||
| CVE-2026-108689 | 1 Wukongopensource | 1 Wukong Aicrm | 2026-10-18 | 5.4 Medium |
| Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows authenticated users to write into other users' AI chat sessions by supplying an arbitrary sessionId to POST /chat/send. Attackers can append messages to a victim's conversation and receive streamed assistant replies built from the victim's last 20 messages, disclosing conversation content. | ||||
| CVE-2026-108672 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-18 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains an authorization bypass vulnerability in the getVideoRecords handler of VideoGenerationController that allows authenticated users to read other users' records via the userId parameter. Low-privileged attackers can supply another user id to retrieve their AI video generation history, including prompts, task ids, video URLs and cover URLs. | ||||
| CVE-2026-108642 | 1 Jeecg | 2 Jeecg-boot, Jeecg Boot | 2026-10-18 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysAnnouncementSendController that allows authenticated users to modify other users' message delivery records. Attackers can obtain delivery ids from GET /sys/sysAnnouncementSend/list and submit edit requests that overwrite read flags, recipient ids, or linked announcements to hide messages from recipients. | ||||
| CVE-2026-108607 | 1 Jeecg | 2 Jeecg Boot, Jeecgboot | 2026-10-18 | 4.3 Medium |
| JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' AI video generation records by supplying arbitrary userId values to DELETE /airag/video/deleteVideoRecord. Attackers can obtain record ids from the unchecked GET /airag/video/listByUser endpoint and delete victims' Redis-stored video history entries one record per request. | ||||
| CVE-2026-108596 | 1 Openlit | 1 Openlit | 2026-10-18 | 5.3 Medium |
| OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace read API to obtain traces including LLM prompts and completions. | ||||