Tagged “cve.org”
CVEs tagged cve.org, newest first.
44841 CVEsRSS
CVE-2026-82413High· 8.8ntopng: authenticated (non-admin) OS command injection via the vulnerability-scan `scan_ports` parameter (`nmap` argument reaches `popen`)
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, scripts/lua/rest/v2/add/host/to_scan.lua and scripts/lua/rest/v2/exec/host/schedule_vulnerability_scan.lua accept scan_ports from any authenticated sessio…
CVE-2026-85287Medium· 6.5HomeBox: Email Case-Sensitivity Bypass Allows Duplicate Account Creation and Login Denial of Service
HomeBox is a home inventory and organization system. Prior to 0.27.0, POST /api/v1/users/register and the users.email uniqueness constraint treat email addresses as case-sensitive while HomeBox uses a case-insensitive login lookup. An un…
CVE-2026-85286Low· 3.7HomeBox: Timing Side-Channel in Login Endpoint Allows User Enumeration via Bcrypt Hashing Delay
HomeBox is a home inventory and organization system. Prior to 0.27.0, the POST /api/v1/users/login endpoint performs password-hash verification only when the submitted username matches an existing account, while unknown usernames return …
CVE-2026-75599Medium· 5.4HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields
HomeBox is a home inventory and organization system. Prior to 0.27.0, the maybeUrl() utility accepts markdown-style links in entity custom-field values without restricting the URL scheme, so an authenticated user can store a javascript: …
CVE-2026-119344Critical· 9.1Cocos Intra-handshake attested TLS implementation is vulnerable to Diversion Attacks
Cocos AI is a confidential computing system for AI. In version 0.8.2 and earlier, Cocos AI accepts trusted execution environment attestation Evidence when firmware patch levels and software measurements match, without binding the Evidenc…
CVE-2026-82912High· 8.8Apache OFBiz: Unsandboxed Groovy compiled from a service parameter
Improper Neutralization of Special Elements Used in an Expression Language Statement ('Expression Language Injection') in EmailServices in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding…
CVE-2026-84728Medium· 5.4Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login
Incorrect Authorization in Apache OFBiz 24.09 before 24.09.08 on all platforms, when documented multitenancy is enabled, allows a remote authenticated attacker holding only a valid low-privilege account in one tenant to read and write…
CVE-2026-104269High· 8.6ModSecurity: RFC 2231 `filename*` Parameter Bypasses Multipart Filename Rules on RFC-Compliant Backends (Go, Python, Node, Java)
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, ModSecurity's multipart parser does not apply the RFC 2231 filename* parameter precedence used by com…
CVE-2026-73856High· 8.6ModSecurity: Response Body Inspection Bypass
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.0 until 3.0.17, src/transaction.cc compares a response Content-Type value against SecResponseBodyMimeType entries cas…
CVE-2026-84183High· 8.8Apache OFBiz: Content Manager VIEW-only RCE in updateLayout
Incorrect Authorization in the updateLayout simple-method in applications/content/minilang/layout/LayoutEvents.xml in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only OFBTOOLS_VIEW a…
CVE-2026-82960High· 8.8Apache OFBiz: Widget use-when Expression Injection Bypasses Groovy Sandbox for authenticated RCE
Improper Control of Generation of Code ('Code Injection') in ModelFormField in the Apache OFBiz cms plugin before 24.09.08 on all platforms allows a remote authenticated attacker holding only CMS content-editor access to execute arbitrar…
CVE-2026-61813Low· 3.7ModSecurity: Incorrect libcurl TLS hostname verification setting in HttpsClient::download
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. Prior to 2.9.15 and 3.0.17, the HttpsClient::download function in src/utils/https_client.cc sets libcurl CURLOPT_SSL_VERIFYHOS…
CVE-2026-83542Critical· 9.8PoCApache OFBiz: Unauthenticated RCE via login-page widget injection
Improper Control of Generation of Code ('Code Injection') in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to execute arbitrary code on the server by staging crafted widget XML in a multipar…
CVE-2026-82916High· 7.1Apache OFBiz: webtools xmldsdump exports any entity to any path
Missing Authorization in XmlDsDump in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the webtools base permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) — explicitly not the ENTITY_MAINT …
CVE-2026-103932Medium· 5.8ModSecurity: PCRE2 `@rxGlobal` match-limit errors are converted to no-match
ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx. From 3.0.5 until 3.0.17, the PCRE2 implementation of @rxGlobal in src/utils/regex.cc converts pcre2_match match-limit errors i…
CVE-2026-82902Medium· 4.3Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile
Server-Side Request Forgery in ViewDataFile in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote authenticated attacker holding only the base webtools permissions (OFBTOOLS_VIEW, WEBTOOLS_VIEW) to cause the server to is…
CVE-2026-82904High· 7.5Apache OFBiz: Unbounded multi-form row count from a parameter name
Uncontrolled Resource Consumption in ServiceMultiEventHandler in Apache OFBiz 24.09 before 24.09.08 on all platforms allows a remote unauthenticated attacker to pin a server request thread for an attacker-chosen number of synchronous ser…
CVE-2026-102615High· 7.6HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS
HeyForm is an open-source form builder. Prior to 3.0.1, /api/upload accepts a file according to the client-controlled multipart file.mimetype while retaining an HTML filename, and static/upload serves the resulting file as text/html with…
CVE-2026-70660Medium· 6.9stable-diffusion.cpp: Out-of-bounds read in safetensors loader: unvalidated data_offsets allow a tensor's byte range to extend past the end of the file
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. Prior to master-764-e22272e, the safetensors loader in src/model_io/safetensors_io.cpp trust…
CVE-2026-70659High· 7.8stable-diffusion.cpp: Heap out-of-bounds write in the imatrix loader (`load_imatrix`) via a duplicate tensor name
stable-diffusion.cpp is a pure C/C++ library for running diffusion model (Stable Diffusion, Flux, Wan, Qwen Image, Z-Image, and more) inference. From master-742-1a13107 until master-763-4fcc6fe, IMatrixCollector::load_imatrix in src/runt…
CVE-2026-123095High· 7.5mpv 0.29.0 before 0.42.0 Playlist Entry Injection via ytdl_hook Newlines
mpv 0.29.0 before 0.42.0 contains a playlist injection vulnerability in the bundled ytdl_hook script that allows remote attackers to add unchecked entries by embedding newlines in playlist URLs. Attackers controlling a feed or page can b…
CVE-2026-123096Medium· 6.5anacrolix/torrent through 1.61.0 Memory Exhaustion via Unbounded HTTP Tracker Response
anacrolix/torrent through 1.61.0 contains a memory exhaustion vulnerability in the tracker/http package that allows malicious trackers to crash clients by returning unbounded responses. Attackers controlling an HTTP tracker in a torrent …
CVE-2026-123094Medium· 5.4Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name
Huginn before 2026.11.05 contains a stored cross-site scripting vulnerability in the service_label helper that marks unescaped OAuth service display names as html_safe. Authenticated attackers can connect an OAuth account with a crafted …
CVE-2026-122329High· 7.8SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in AIFF Decoder
SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow in FetchXLaw() in src/decoder_aiff.c due to miscalculated output offsets when expanding A-law or mu-law samples. Attackers can supply a crafted AIFF-C file that overwri…
CVE-2026-122317Medium· 4.3SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to retrieve any account's details by supplying arbitrary userId values to user.getUserDetails. Attackers can iterate sequential integer…
CVE-2026-122328High· 7.8SDL_mixer 3.1.2 through 3.2.4 Stack-based Buffer Overflow via FetchXLaw() in WAV Decoder
SDL_mixer 3.1.2 through 3.2.4 contains a stack-based buffer overflow vulnerability in FetchXLaw() of src/decoder_wav.c when decoding A-law or mu-law WAV files. Attackers can supply a crafted WAV file whose doubly-offset float expansion o…
CVE-2026-122325Low· 3.1eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API
fossasia eventyay-exhibition through commit f68888e contains an authorization bypass vulnerability in the exhibitor lead creation API that allows exhibitors to access other organizers' attendee data. Exhibitors with lead scanning enabled…
CVE-2026-122324Low· 3.1SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails
SplitPro through 2.1.6 contains an authorization bypass vulnerability that allows authenticated users to read other users' expenses by supplying arbitrary expenseId values to expense.getExpenseDetails. Attackers who obtain an expense UUI…
CVE-2026-122327Medium· 4.3Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints
Meelo through 3.13.1 contains a missing authorization vulnerability that allows authenticated non-admin users to modify shared catalog data because RolesGuard does not require Admin on song, track and video write routes. Attackers can se…
CVE-2026-106716NoneReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin
ReelShort for Android version 3.8.55 loads an attacker-controlled activityUrl supplied through its cmsvictor://open deep link in a WebView that exposes the Android and Offerwall JavaScript bridges without validating the page origin. Afte…