Tagged “cve.org”
CVEs tagged cve.org, newest first.
46495 CVEsRSS
CVE-2026-120439High· 7.0PoCQuickJS-NG before 0.16.0 Heap Buffer Overflow via TypedArray.prototype.sort
QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to cause a heap buffer overflow on 32-bit hosts. Attackers who can run JavaScript can call TypedArray.prototype.sort with a…
CVE-2026-120434High· 7.8Netpbm before 10.86.51, 11.02.30, and 11.15.08 picttoppm Stack Overflow via scanPoly
Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in picttoppm's scanPoly() function in converter/ppm/picttoppm.c. Attackers can supply a crafted PICT file whose polygon edges …
CVE-2026-120431High· 7.8Netpbm before 10.86.51, 11.02.29, and 11.15.07 sgitopnm Heap Buffer Overflow
Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in sgitopnm's readChannels() function when processing RLE-compressed SGI images. Attackers can supply crafted SGI files with ov…
CVE-2026-120430Medium· 5.4Camaleon CMS before 2.9.2 IDOR via Admin::CategoriesController
Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController that allows authenticated users to modify unauthorized categories by referencing arbitrary category IDs. Users authorized…
CVE-2026-120427Medium· 4.3PoCMrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read
MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated users to read other users' document templates. Attackers can enumerate the sequential doctemp_id POST parameter to retri…
CVE-2026-120426High· 7.5OpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read via Resolve Route
OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve route that allows remote attackers to read private repository files. Attackers can inject a percent-encoded current_user …
CVE-2026-120283Critical· 10.0Linksys E8450 portal.cgi strcpy stack-based overflow
A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be…
CVE-2025-71450Low· 3.3PoCinih before r63 Stack Buffer Under-Read in ini_parse_stream Discard Loop
inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to read abyss[-1] via an embedded NUL byte after an overlong line. Attackers can supply an INI file or string with a line of…
CVE-2026-120323Medium· 4.3PoCsamanhappy MCPHub passthroughHeaders.ts information disclosure
A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosu…
CVE-2026-120309Low· 3.7Nuxt 4.6.0 before 4.6.2 Route Param Confusion via getRouterParam
Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths containing an encoded q…
CVE-2026-120335Medium· 4.8PoCdeepset-ai farm Model Package Loader language_model.py WordEmbedding_LM.load path traversal
A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbedding_LM.load of the file farm/modeling/language_model.py of the component Model Package Loader. The manipulation of the argument embeddings_…
CVE-2026-120340Low· 3.7mathurvishal CloudClassroom-PHP-Project Global Session session expiration
A weakness has been identified in mathurvishal CloudClassroom-PHP-Project. This issue affects some unknown processing of the component Global Session Handler. Executing a manipulation can lead to session expiration. The attack may be lau…
CVE-2026-120317Medium· 5.9PoChttp4k 4.9.10.0 before 6.60.0.0 Digest auth-int Missing Body Integrity
http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body …
CVE-2026-120344Critical· 10.0PoCWAVLINK WN551X3-A WireGuard CLI Group ioos system os command injection
A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os c…
CVE-2026-120313High· 7.5PoCNetwork-AI before 5.15.5 Path Traversal via InputSanitizer.sanitizePath
Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a …
CVE-2026-120349High· 7.3PoCdayrui XunRuiCMS Mobile Site Directory index.php str_replace code injection
A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument di…
CVE-2026-91911Medium· 6.1Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially expl…
CVE-2026-91906Medium· 5.5Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Pr…
CVE-2026-120463Medium· 6.5PoCWarracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linking
Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another u…
CVE-2026-114364Critical· 9.8Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execut…
CVE-2026-91904Medium· 5.5Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Pr…
CVE-2026-91910Medium· 5.7Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with adjacent network access could potentially explo…
CVE-2026-91907Medium· 6.8Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit…
CVE-2026-120347High· 7.3PoCdayrui XunRuiCMS Member View.php View sql injection
A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection.…
CVE-2026-120345Critical· 10.0PoCWAVLINK WN551X3-A DNS Resolution ioos sub_41a430 os command injection
A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os com…
CVE-2026-120337High· 7.3PoCVStarcam O-KAM SuperIPCam P2P Session Teardown SuperIPCam.exe FUN_005a2d44 use after free
A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperIPCam.exe of the component P2P Session Teardown. This manipulation causes use after free. The atta…
CVE-2026-120342High· 7.3PoCmathurvishal CloudClassroom-PHP-Project viewquery.php sql injection
A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed rem…
CVE-2026-120325Medium· 6.3PoCWebpro-nl Knip Workspace IssueFixer.ts writeFile path traversal
A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packages/knip/src/IssueFixer.ts of the component Workspace Handler. Such manipulation of the argument w…
CVE-2026-120315High· 8.8PoCLobeHub Chat 1.84.26 before 2.1.49 Path Traversal RCE via writeTempFile
LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile(). Attackers can create a file record via file.…
CVE-2026-120311High· 8.8PoCNetwork-AI 5.13.4 before 5.15.5 Path Traversal via FileJobStore Job ID
Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passe…