Tagged “cve.org”
CVEs tagged cve.org, newest first.
46567 CVEsRSS
CVE-2026-119364Medium· 5.3ProFTPD through 1.3.9e and 1.3.10rc4 mod_copy Symlink Following Write Bypass
ProFTPD through 1.3.9e and 1.3.10rc1 through 1.3.10rc4 contains a link-following vulnerability in mod_copy that allows authenticated FTP users to bypass Limit WRITE restrictions via symlinks. Attackers can place a symlink in a writable d…
CVE-2026-103039Critical· 9.8PoCGravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field
The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted v…
CVE-2026-119417Low· 3.7CakePHP through 5.4.3 Email Header Injection via Bare CR/LF in SmtpTransport and MailTransport
CakePHP 4.5.12, 4.6.5, 5.1.8 through 5.1.10, 5.2.14 through 5.2.15, 5.3.7, and 5.4.0 through 5.4.3 contain an email header injection vulnerability because SmtpTransport and MailTransport strip only CRLF pairs from header values, an incom…
CVE-2026-119409High· 7.2OPNsense before 26.7.8 Root Command Injection via Firmware Mirror Setting
OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to execute commands as root by storing a malicious firmware mirror URL. Attackers can submit shell meta…
CVE-2026-119429Medium· 4.3phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit ke…
CVE-2026-119548Low· 3.1Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook
Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organization to mark another organization's invoice as paid due to an unscoped invoice lookup. Attackers con…
CVE-2026-119425Medium· 5.4OPNsense 26.1.6 through 26.7.7 Captive Portal Session Takeover via Forged ARP
OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthenticated attackers hijack authorized client sessions by spoofing unauthenticated MAC-to-IP observa…
CVE-2026-119560Medium· 5.9OPNsense core through 26.7.8 NTP Configuration Injection via GPS and PPS Fudge Fields
OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives by embedding newlines in the fudge and refid fields. Attackers holding the page-services-ntp-gps…
CVE-2026-119421Medium· 5.9Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation
Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticated attackers to confirm payouts with any client_secret via POST /payouts/{payout_id}/confirm. Att…
CVE-2026-119552Medium· 4.8Uptime Kuma through 2.5.8 Race Condition Admin Creation via Setup Handler
Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create an additional administrator account. Attackers can send concurrent setup requests during the bcr…
CVE-2026-119577Medium· 6.8ArcadeDB before 26.10.2 Improper Session Revocation in Wire-Protocol Connections
ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access through already-open Postgres, Bolt, MongoDB, or Redis wire-protocol connections. Attackers holding an existing connectio…
CVE-2026-119556Medium· 4.3Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade it…
CVE-2026-119569Medium· 5.3Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service
Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot not…
CVE-2026-119573Medium· 4.4Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret
Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check on the auth-tls-secret annotation when a cached client authentication TLS option is reused. Users…
CVE-2026-119564Medium· 5.3Plausible Analytics through 3.2.1 Site Takeover via Exposed Invitation IDs
Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pending invitation and ownership-transfer IDs from the settings/people page. Attackers can register wit…
CVE-2026-119568High· 7.4vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking
vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FTPS data connections by resuming their own TLS session ticket. Attackers sharing the victim's sour…
CVE-2026-119602Low· 3.7libmspack through 0.11alpha Uninitialized Memory Disclosure via MS-ZIP Decompressor Window
libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that allows attackers to leak heap data via unchecked back-reference distances. Attackers can supply a crafted MS-ZIP CAB fi…
CVE-2026-119598Medium· 4.3Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id
Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authenticated users to read other users' configurations. Attackers can iterate the global auto-increment e…
CVE-2026-119542Medium· 4.3Org.infinispan/infinispan-query: infinispan: deeply nested ickle queries can trigger a stackoverflowerror
A flaw was found in the Ickle query parser in Infinispan. A query containing deeply nested predicates can cause recursive parsing to exhaust the Java thread stack and throw an uncaught StackOverflowError. An authenticated user with BULK_…
CVE-2026-119645Medium· 6.5ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc
ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read documents without checkPrivDoc() access checks. Low-privilege attackers can enumerate sequential document…
CVE-2026-119649High· 7.1Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check
Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that allows authenticated Authors and Contributors to access other users' media. Attackers can display, …
CVE-2026-119375Medium· 5.5SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose o…
CVE-2026-119657Medium· 5.0FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations
FilePress through 3.0.1 contains a missing authorization vulnerability in dzz/pichome/library that allows authenticated users to manage other libraries' folders because checkuserperm_by_uid only checks membership of any library. Attacker…
CVE-2026-119653Medium· 4.3Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path
Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-man…
CVE-2026-119665Medium· 6.3WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIs
WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another projec…
CVE-2026-119661Medium· 4.2ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries
ShowDoc through 3.9.5 contains an authorization bypass vulnerability in the api/paramDescLib/deleteEntries endpoint that checks edit permission only for the first supplied entry id. Authenticated attackers can place their own entry id fi…
CVE-2026-61708High· 8.5SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `POST /api/agent_data_store/upload` in `backend/app/data_store/data_store_routes.py` permits `customer_user` callers…
CVE-2026-61737Critical· 9.8ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin
ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery when a deployment has not replaced the default secret, without a startup warning. An attacker ca…
CVE-2026-61627High· 7.3libass: Out-of-bounds read and write in wrap_lines_measure
libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, libass can overread and overwrite the glyph array in `wrap_lines_measure` while rendering malicious `…
CVE-2026-45145High· 7.5Chamilo LMS: Database-backed PHP object injection in career deserialization
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, `public/main/inc/lib/career.lib.php` and `public/main/cron/import_csv.php` call PHP's native `unserialize()` on `user_career.extra_data` retrieved from the databas…