Export limit exceeded: 375115 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 375115 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 375115 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (375115 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-71289 | 1 Nasa-ammos | 1 Anms | 2026-08-10 | 9.8 Critical |
| The NASA-AMMOS Asynchronous Network Management System (ANMS) reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface (port 8089, e.g. ":8089/tcp") with cap_add: NET_ADMIN, NET_RAW, SYS_NICE, bypassing the CAM (Configuration and Access Manager) gateway that is otherwise the system's sole authentication boundary. | ||||
| CVE-2026-71288 | 1 Koha-community | 1 Koha | 2026-08-10 | 8.8 High |
| Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist. | ||||
| CVE-2026-71287 | 1 Cacti | 1 Cacti | 2026-08-10 | 8.8 High |
| Cacti's sanitize_sql_column (lib/functions.php) sanitizes user-supplied ORDER BY column names using the regex . Because this allowlist retains letters, digits, underscore, parentheses, and dot (intended to support expressions like COUNT(id) and table.column), a payload such as passes through completely unmodified. | ||||
| CVE-2026-71286 | 1 Miguelcobain | 1 Ember-dynamic-render-template | 2026-08-10 | 6.1 Medium |
| The render-template component of ember-dynamic-render-template (addon/components/render-template.js) passes its property directly into Ember/Glimmer's compileTemplate (from @ember/template-compilation) with no sanitization, allow-listing, or validation of the input. | ||||
| CVE-2026-71285 | 1 Louislam | 1 Uptime-kuma | 2026-08-10 | 8.1 High |
| Uptime Kuma's Matomo analytics integration (server/analytics/matomo-analytics.js) injects the admin-configurable Matomo value as a bare, unquoted JavaScript expression inside a <script> block rendered on every public status page. A siteId value such as , once saved by an editor/admin, executes arbitrary JavaScript for every unauthenticated visitor of the public /status/<slug> page, enabling session-cookie theft and full page takeover. | ||||
| CVE-2026-71284 | 1 Fledge-iot | 1 Fledge | 2026-08-10 | 7.2 High |
| Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), takes the first extracted tar member's filename (tar_file_names[0]) and builds a shell command via string formatting. Because os.system invokes a shell and no quoting (shlex.quote, list-form subprocess) is applied, an admin uploading a crafted backup archive achieves arbitrary OS command execution. | ||||
| CVE-2026-71283 | 1 Fledge-iot | 1 Fledge | 2026-08-10 | 4.9 Medium |
| Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restore.py), calls tarfile.extractall(temp_path) on an admin-uploaded tar archive with no filter argument and no per-member path validation. Requires the admin role (@has_permission("admin")). | ||||
| CVE-2026-71282 | 1 Chirpstack | 1 Chirpstack | 2026-08-10 | 6.5 Medium |
| ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind. | ||||
| CVE-2026-71281 | 1 Huggingface | 1 Peft | 2026-08-10 | 8.8 High |
| Hugging Face peft's LoRA-GA and CorDA initialization modules (src/peft/tuners/lora/corda.py lines ~102 and ~163, and src/peft/tuners/lora/loraga.py line ~101) call torch.load on config-specified cache/covariance files without weights_only=True, bypassing peft's own safe-loading wrapper used elsewhere in the codebase. | ||||
| CVE-2026-71280 | 1 Go-shiori | 1 Shiori | 2026-08-10 | 8.5 High |
| go-shiori's DownloadBookmark (internal/core/download.go) fetches a caller-supplied bookmark URL using a plain http.Client with no custom DialContext or destination-IP validation (no IsLoopback, IsPrivate, IsUnspecified, or IsLinkLocalUnicast checks). | ||||
| CVE-2026-71279 | 1 Koenkk | 1 Zigbee2mqtt | 2026-08-10 | 8.1 High |
| Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter received via an MQTT message (topic zigbee2mqtt/bridge/request/extension/save) into the extensions base path using path.join(basePath, name) with no sanitization. The extension handler only validates that the name ends in .js/.mjs/.cjs, writes the file, and then dynamically imports it via Node.js import, achieving remote code execution. | ||||
| CVE-2026-71278 | 1 Iot-ecology | 1 Rust-iot-platform | 2026-08-10 | 9.8 Critical |
| rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable without authentication. | ||||
| CVE-2026-71277 | 1 Iot-ecology | 1 Rust-iot-platform | 2026-08-10 | 9.1 Critical |
| rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty Authorization header (e.g. ) satisfies the guard, granting access to every endpoint protected only by this request guard. | ||||
| CVE-2026-71276 | 1 Absmach | 1 Magistrala | 2026-08-10 | 7.1 High |
| Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader (readers/postgres/messages.go: ) and the TimescaleDB reader (readers/timescale/messages.go, same pattern), enabling SQL injection by any authenticated user able to query channel messages. | ||||
| CVE-2026-71274 | 1 Openshwprojects | 1 Openbk7231t App | 2026-08-10 | 8.5 High |
| OpenBK7231T's CHANNEL_SetLabel (src/cmnds/cmd_channels.c) stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNEL_GetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/http_fns.c with no HTML encoding. | ||||
| CVE-2026-71273 | 1 Openshwprojects | 1 Openbk7231t App | 2026-08-10 | 6.5 Medium |
| OpenBK7231T's /cfg_wifi_set endpoint (src/httpserver/http_fns.c) accepts configuration changes via a plain GET request with no CSRF token. If the parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string. | ||||
| CVE-2026-71272 | 1 Usememos | 1 Memos | 2026-08-10 | 8.5 High |
| Memos' webhook dispatch function safeDialContext (internal/webhook/webhook.go) resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the original hostname rather than the already-validated IP address. | ||||
| CVE-2026-71271 | 1 Usememos | 1 Memos | 2026-08-10 | 8.5 High |
| Memos' webhook URL validation, isReservedIP (internal/webhook/validate.go), checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/html_meta.go, which does. | ||||
| CVE-2026-71270 | 1 Stirling | 1 Stirling Pdf | 2026-08-10 | 8.6 High |
| Stirling-PDF's POST /api/v1/convert/url/pdf endpoint (ConvertWebsiteToPDF.java) was not updated with the CustomHtmlSanitizer/SsrfProtectionService SSRF protections that were added to three sibling conversion endpoints (html/pdf, file/pdf, markdown/pdf). | ||||
| CVE-2026-71269 | 1 Nodered | 1 Node-red | 2026-08-10 | 7.2 High |
| Node-RED's local-filesystem library storage module (getLibraryEntry and saveLibraryEntry in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js), reachable via GET/POST /library/:lib/:type/*path, joins the user-supplied path parameter directly into the filesystem path via fspath.join(libDir, type, path) with no traversal sanitization, containment check, or path normalization/prefix verification. | ||||