Tagged “cve.org”
CVEs tagged cve.org, newest first.
47132 CVEsRSS
CVE-2026-118991High· 7.5CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key
CallBackery versions before 0.62.0 for Perl encrypt configuration backups with the padded password as the AES key. getCrypt() pads the backup password with "x" characters and cuts it to 32 bytes to form the AES key, with no salt and no …
CVE-2026-118996Medium· 4.9CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig
CallBackery versions before 0.62.0 for Perl send users their own password hash and the admin-only user note via getUserConfig. getUserConfig() returns the caller's whole cbuser row, including the stored password hash and the note field …
CVE-2026-118994Critical· 9.8CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name
CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login name. login() writes the login name to the application log without escaping control characters. The login RPC method needs no authentication, so a…
CVE-2026-118993High· 7.5CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI
CallBackery versions before 0.62.0 for Perl allow denial of service via the request path interpolated as a regular expression under CGI, FastCGI and PSGI. The before_dispatch hook installed by startup() removes PATH_INFO from the end of…
CVE-2026-118995Critical· 9.1CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator
CallBackery versions before 0.62.0 for Perl accept unintended values in form fields checked by createRxValidator. createRxValidator() is documented to anchor the supplied pattern at both ends, but builds /^${rx}$/ without grouping the p…
CVE-2026-13576High· 7.5CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes
CallBackery versions before 0.62.0 for Perl store user passwords as unsalted HMAC-SHA1 hashes. Passwords are hashed with hmac_sha1_sum() from Mojo::Util with no key, a single fast SHA-1 HMAC. There is no salt, so equal passwords give eq…
CVE-2026-119038Medium· 6.1Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate
Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate. confirm_resource takes no session token…
CVE-2026-119037High· 7.5Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty
Business::GoCardless versions before 1.01 for Perl accept forged webhooks when a configured webhook secret is undef or empty. signature_valid uses each configured secret as the HMAC key, and nothing rejects undef or an empty string, bot…
CVE-2026-119036High· 7.5Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature
Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening legacy webhook payloads before checking their signature. A webhook body with a top-level "payload" key is verified as a legacy webhook. To rebuild …
CVE-2026-116128High· 7.5Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies
Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded buffering when decoding chunked request bodies. The decoder adds each read to one buffer of unconsumed input. Nothing limits the length of a chunk-siz…
CVE-2026-115866High· 7.5Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies
Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular expression backtracking when decoding chunked request bodies. A chunk-size line is matched as a run of hex digits, then .* and a CRLF. A run followed by a …
CVE-2026-116127Critical· 9.1Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection
Starlet versions before 0.33 for Perl send a body in responses to HEAD requests, corrupting the next response on a persistent or pipelined connection. The request method is not passed to the response writer, so whatever body the applica…
CVE-2026-115865High· 7.5Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory
Starlet versions before 0.33 for Perl allow a request declaring a large Content-Length to kill a worker by exhausting memory. The request body is read in a loop that asks sysread for all of the remaining declared length at once. Perl gr…
CVE-2026-62848High· 7.3Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution
Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#. From 2023.0.101-rc until 2025.1.18, 2026.0.25 and 2026.1.19, the Windows Visual Studio integration deserializes local named-pipe messages without restrictin…
CVE-2026-112374Medium· 4.3FOSSBilling before 0.8.9 Login CSRF via Staff Guest Login API
FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST /api/guest/staff/login) that allows remote attackers to force authentication because checkGuestClientAuthentication() on…
CVE-2026-119591Medium· 5.5PoCSQLite before 3.54.0 Stack Exhaustion via countOfViewOptimization() in VALUES Clause
SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file wit…
CVE-2026-119567Low· 3.1vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases
vsftpd through 3.0.5 contains an access control bypass vulnerability that allows authenticated FTP users to execute denied commands by issuing RFC 775 X-prefixed aliases. The cmds_denied check in process_post_login() compares literal tok…
CVE-2026-119566Medium· 4.8Prometheus through 3.15.1 Credential Leak via remote_write Cross-Host Redirects
Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by redirecting remote_write requests to another host. Attackers controlling the remote-write endpoin…
CVE-2026-119563Medium· 5.4phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE privilege to inject script via unescaped table names in DesignerHistory.display(). Attackers can create a table whose na…
CVE-2026-119562Medium· 4.2phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_extra and col_attribute values to /database/central-columns. Attackers can inject SQL into pma__cen…
CVE-2026-119559Medium· 5.9PoCOpenLiteSpeed through 1.9.4 mTLS Bypass via HTTP/3 SNI and Host Mismatch
OpenLiteSpeed through 1.9.4 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to evade virtual host client certificate requirements over HTTP/3. Because QuicStream inherits a verifyContext() imp…
CVE-2026-119558Low· 3.1OpenCart through 4.1.0.4 Payment Bypass via Free Checkout Reward Points
OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by clearing reward points after selecting Free Checkout. Attackers can apply points, save Free Checkout, t…
CVE-2026-119547Medium· 4.3PoCForgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains an information disclosure vulnerability in the GetPublicKey API handler that lacks an ownership check on key lookups. Authenticated users with a read:user…
CVE-2026-119555Medium· 4.3Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback
Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain an information disclosure vulnerability in the core_grades_get_feedback web service. The service lacks group-membership and en…
CVE-2026-119554Medium· 5.9Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 SQL Injection via enrol_database Course idnumber
Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in the External database enrolment plugin via course idnumber. Editing teachers can store a backslash…
CVE-2026-119551Medium· 6.5Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions
Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. …
CVE-2026-119550Low· 3.5Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}
Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled…
CVE-2026-119546Medium· 5.5PoCForgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo
Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can suppl…
CVE-2026-119428Low· 3.7PoCphpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled
phpMyAdmin through 5.2.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound connections via setup/validate.php, which lacks the setup-disabled guard. Attackers can POST attacker…
CVE-2026-119427Medium· 4.2phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting
phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via unescaped json_encode() output. Attackers can send crafted index or value parameters with operat…