Tagged “cve.org”
CVEs tagged cve.org, newest first.
47132 CVEsRSS
CVE-2026-119680High· 8.5Stored Cross-Site Scripting (XSS) in SharePoint Manager Plus Chart Feature
A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to improper sanitization and HTML encoding of user-controlled data. An attacker can inject malicious HTML or JavaScript i…
CVE-2026-119652Medium· 4.3PoCHuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure
HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FriendController.friendList that allows authenticated users to view other users' friend lists by supplying a uid parameter. Attackers can send GET re…
CVE-2026-119648Medium· 4.3PoCBlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail
Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search co…
CVE-2026-119660Critical· 9.8PoCMuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key
MuseBot before 2.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin sessions by using the hard-coded default session_key 'muse_bot_session_key'. Attackers can sign a MuseBot-session c…
CVE-2026-119644Medium· 5.4PoCBlossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints
Blossom through 1.17.1 contains an authorization bypass vulnerability that allows authenticated non-readonly users to modify other users' pictures by supplying arbitrary picture ids. Attackers can call the picture delete, /picture/del/ba…
CVE-2026-100355Low· 3.1Campfire vulnerable to SSRF via incomplete private-network denylist in the link-unfurl guard
Campfire is a web-based chat application. In version 1.4.4 and earlier, when a Campfire message contains a link, the server fetches it to build an OpenGraph unfurl preview. `RestrictedHTTP::PrivateNetworkGuard` relied on Ruby's `IPAddr#p…
CVE-2026-111498Medium· 4.7OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability
OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.
CVE-2026-86715High· 7.1Clear Text Storage of Password in Crypttech's Vatos DLP
Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use of Known Domain Credentials. This issue affects Vatos DLP: from 1.1.176 before 1.1.243.
CVE-2026-119599Medium· 4.3PoCAxonHub through 1.0.0-beta11 Privilege Escalation via Service Account API Key Scopes
AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creating service_account API keys with unvalidated scopes. Attackers holding write_api_keys can mint ke…
CVE-2026-117350Medium· 6.5Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.
Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.
CVE-2026-119578High· 7.8PoCMONAI 1.6.0 before 1.6.1 Code Execution via Auto3DSeg algo_from_json()
MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows attackers to run Python code via a crafted work directory's algo_object.json. Attackers can ship a malicious algorithm…
CVE-2026-112347High· 7.6Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API
Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in Pag…
CVE-2026-114422High· 7.5Enable Media Replace 4.1.4 - 4.2.2 - Unauthenticated PHP Object Injection via Metadata Replacer
The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its media replace-and-update-links routine, allowing unauthenticated users to inject a PHP object that…
CVE-2026-114443High· 7.5Security by CleanTalk < 2.191 - Unauthenticated Authentication Bypass via Authenticator App Code
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before accepting an authenticator-app two-factor code at login, allowing anyone who holds a user's curre…
CVE-2026-114444Medium· 4.4Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer
The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin admi…
CVE-2026-115277Medium· 4.7WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter
The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The af…
CVE-2026-117572Medium· 4.1WP Visitor Statistics (Real Time Traffic) < 8.8 - Admin+ SQLi via 'order' Parameter
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL statement, allowing high-privilege users such as administrators to perform SQL injection attacks.
CVE-2026-118072Medium· 5.4Fraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer Blacklisting
The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users…
CVE-2026-118100Medium· 5.3BuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure
The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification…
CVE-2026-118101Medium· 5.3BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification
The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the titl…
CVE-2026-117571High· 8.8WP Visitor Statistics (Real Time Traffic) < 8.8 - Unauthenticated Stored XSS via Tracker Device Parameters
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public visitor requests before storing it and outputting it in the administrative statistics dashboard, all…
CVE-2026-118071Medium· 6.8Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site S…
CVE-2026-118165Medium· 6.8Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute
The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Store…
CVE-2026-119576Medium· 4.3PoCArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint
ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definitio…
CVE-2026-118987Medium· 5.3CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header
CallBackery versions before 0.62.0 for Perl accept session cookies of any age sent in the X-Session-Cookie header. cookieConf() rejects a cookie older than 300 seconds only when it arrives in the xsc query parameter. The same cookie sen…
CVE-2026-119572High· 8.7Traefik 3.7.0-ea.1 before 3.7.15 mTLS Bypass via Ingress NGINX Provider
Traefik from 3.7.0-ea.1 before 3.7.15 contains an authentication bypass vulnerability in the Kubernetes Ingress NGINX provider that silently disables mTLS configured via the auth-tls-secret annotation. When another Ingress declares a pat…
CVE-2026-119601Medium· 6.1PoCAFFLIB through 3.7.22 Heap Out-of-Bounds Write in af_get_page
AFFLIB through 3.7.22 contains a heap out-of-bounds write vulnerability in af_get_page() that allows attackers to corrupt heap memory by supplying crafted AFF images with mismatched page and sector sizes. Attackers can set a page size la…
CVE-2026-118990Medium· 5.5CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup
CallBackery versions before 0.62.0 for Perl leave a world-readable dump of the configuration database in /tmp when taking a configuration backup. getConfigBlob() has the sqlite3 shell write the dump to /tmp/cbdump<pid> and never removes…
CVE-2026-119597Critical· 9.8PoCOpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery
OpenDeepWiki through 2.0.6 contains a hard-coded JWT signing key vulnerability that allows unauthenticated attackers to forge administrator tokens using the publicly known Jwt:SecretKey in appsettings.json. Attackers can mint HS256 beare…
CVE-2026-118986High· 7.5CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand()
CallBackery versions before 0.62.0 for Perl allow session cookie forgery via a signing secret generated with rand(). The secret that signs session cookies is built from two calls to the built-in rand(), which is seeded with 32 bits. The…