Export limit exceeded: 377395 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377395 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-73611 | 1 Filebrowser | 1 Filebrowser | 2026-08-14 | 6.8 Medium |
| File Browser versions from 2.50.0 through 2.63.21 fail to validate JWT expiration when proxy authentication is configured with a non-default logout page. Attackers with a previously valid token can access protected routes and administrative endpoints indefinitely, and exchange expired tokens for fresh ones via the renewal endpoint. | ||||
| CVE-2026-73610 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-14 | 5.8 Medium |
| SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document identifiers, and expanded folder paths by calling the getLocalStorage endpoint. | ||||
| CVE-2026-73608 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-14 | 8.6 High |
| SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with CheckAuth only and performs no authorization checks (no CheckReadonly, no publish-access or encrypted-notebook gating). Given a database identifier taken from a published page and a keyword, an anonymous reader can query the endpoint to retrieve matching database row content, including rows that publish filters (FilterAttributeViewByPublishAccess) would otherwise withhold. No released stable version is affected. | ||||
| CVE-2026-73607 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-14 | 5.8 Medium |
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester. | ||||
| CVE-2026-73606 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-14 | 5.8 Medium |
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers without entering the document password. | ||||
| CVE-2026-73533 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Ninja Tables | 2026-08-14 | 9.8 Critical |
| Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal. | ||||
| CVE-2026-73515 | 1 Postgis | 1 Postgis | 2026-08-14 | 8.1 High |
| PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service. | ||||
| CVE-2026-73332 | 2 Owen2345, Tuzitio | 2 Camaleon Cms, Camaleon Cms | 2026-08-14 | 8.7 High |
| CamaleonCMS contains a stored cross-site scripting vulnerability in the cama_contact_form plugin that allows low-privileged authenticated attackers to inject arbitrary HTML by submitting unsanitized content to the before_html field through the contact form edit endpoint, which lacks proper authorization controls. Attackers can persist malicious script payloads into the database that execute in victims' browsers when the contact form loads, enabling cookie theft, forged authenticated requests against the admin interface, and session takeover of viewing users. | ||||
| CVE-2026-73331 | 2 Owen2345, Tuzitio | 2 Camaleon Cms, Camaleon Cms | 2026-08-14 | 7.1 High |
| CamaleonCMS 2.9.1 contains an authenticated SQL injection vulnerability that allows authenticated attackers with post creation or editing privileges to submit a crafted slug value containing SQL syntax that the database backend evaluates as part of an inadequately parameterized query. Attackers can supply malicious slug payloads using boolean- or union-style blind SQL injection techniques to extract sensitive data from the underlying SQLite database, including administrative credentials and configuration values stored in application tables. | ||||
| CVE-2026-73330 | 2 Owen2345, Tuzitio | 2 Camaleon Cms, Camaleon Cms | 2026-08-14 | 6.6 Medium |
| CamaleonCMS 2.9.1 contains a server-side template injection vulnerability that allows authenticated administrators to execute arbitrary commands by embedding ERB tags in the email parameter of the test_email settings action, which are evaluated when an SMTP rejection reflects the recipient address back in the exception message rendered as an inline ERB template. Attackers can submit a crafted email parameter containing ERB expressions through the admin settings test_email endpoint, causing the Rails inline template renderer to evaluate attacker-controlled Ruby code and achieve arbitrary command execution as the Rails process user. | ||||
| CVE-2026-73329 | 2 Owen2345, Tuzitio | 2 Camaleon Cms, Camaleon Cms | 2026-08-14 | 8.7 High |
| CamaleonCMS contains a stored cross-site scripting vulnerability that allows authenticated low-privileged users to execute arbitrary JavaScript in an administrator's browser by injecting unsanitized HTML payloads into the post title parameter during draft creation. Attackers can submit a malicious HTML payload as a draft title through the drafts creation endpoint, which is persisted to the database without escaping and later rendered as raw HTML in the admin drafts listing, enabling administrator session compromise, cookie theft, and forged authenticated requests. | ||||
| CVE-2026-73327 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-08-14 | 7.6 High |
| Joomla 6.1.1 contains a path traversal vulnerability in the com_joomlaupdate extension that allows a Super User to be induced into extracting a crafted archive containing directory traversal sequences or absolute paths in ZIP entry filenames. Attackers can supply malicious ZIP entry names with parent-directory segments or absolute paths to the extract.php extraction routine, causing files to be written outside the intended destination root and enabling persistent remote code execution via planted PHP files. | ||||
| CVE-2026-73326 | 2 Owen2345, Tuzitio | 2 Camaleon Cms, Camaleon Cms | 2026-08-14 | 7.6 High |
| CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers can manipulate plugin configuration parameters at runtime across the attack, front_cache, cama_meta_tag, and cama_contact_form plugins to alter cached page behavior, modify public meta-tag output, or reconfigure contact forms, enabling account takeover when chained with stored cross-site scripting through the contact form's before_html field. | ||||
| CVE-2026-73049 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-14 | 5.8 Medium |
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getAttributeViewBacklinks endpoint that consults the forbidden access list instead of the visibility list when filtering backlinks. Anonymous readers can supply a publicly visible database row identifier to discover hidden-tier documents that reference it, receiving the database name, row title, and document path of hidden documents. | ||||
| CVE-2026-73048 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-14 | 5.8 Medium |
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getRefIDsByFileAnnotationID endpoint that returns block identifiers citing PDF annotations without publish-access filtering. Attackers can extract block identifiers from restricted documents by supplying annotation identifiers visible in published pages, revealing citation relationships across forbidden and password-protected tiers. | ||||
| CVE-2026-73038 | 1 Nodebb | 1 Nodebb | 2026-08-14 | 6.1 Medium |
| NodeBB before 4.15.0 contains a stored cross-site scripting vulnerability in the renderEmoji function that fails to escape tag.icon.url and tag.name attributes. Attackers can deliver malicious ActivityPub Create/Note objects with crafted emoji tags to inject arbitrary HTML and JavaScript into stored post content, executing code in all viewers' browsers. | ||||
| CVE-2026-73034 | 2 Dbgpt, Eosphoros-ai | 2 Db-gpt, Db-gpt | 2026-08-14 | 9.8 Critical |
| DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted multipart upload request with a traversal-poisoned user_id header to escape the intended upload directory and write attacker-controlled content to locations such as Python startup hooks, cron directories, or agent scripts, resulting in remote code execution. | ||||
| CVE-2026-72841 | 1 Openwrt | 1 Luci | 2026-08-14 | 9.9 Critical |
| luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path traversal and write arbitrary files outside the intended directory. Attackers can upload malicious payloads to gain persistent root code execution by placing SSH keys in system directories accessible on reboot. | ||||
| CVE-2026-72840 | 1 Openwrt | 1 Luci | 2026-08-14 | 8.8 High |
| OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write, which the default busybox crond daemon executes as root within one minute. | ||||
| CVE-2026-72838 | 1 Filebrowser | 1 Filebrowser | 2026-08-14 | 6.5 Medium |
| FileBrowser versions before 2.63.19 fail to enforce the declared Upload-Length in the TUS resumable-upload PATCH endpoint, allowing authenticated users to write arbitrary data to disk. Attackers can send oversized request bodies that exceed the declared upload length to exhaust available disk space and cause service unavailability. | ||||