Tagged “cve.org”
CVEs tagged cve.org, newest first.
47453 CVEsRSS
CVE-2026-114129Medium· 6.2PoCstream-json: FlexAssembler string/RegExp path filters join the full key stack per container start, giving O(depth^2) CPU denial of service
stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, FlexAssembler compiles string and regular-expression path filters into matchers that join the full…
CVE-2026-114132Medium· 6.3Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only b…
CVE-2026-110744High· 7.2Multicluster-global-hub-operator-bundle: operator serviceaccount granted unrestricted impersonation of users, groups and serviceaccounts cluster-wide
A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) permissions that grant cluster-wide impersonation of arbitrary users, groups, and service accounts…
CVE-2026-114492Medium· 6.5gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a c…
CVE-2026-114491Medium· 5.3pdfmake 0.3.8 before 0.3.12 Local File Policy Bypass via SVG Images
pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image hre…
CVE-2026-114133Medium· 5.4Nuxt server islands render `useHeadSafe` input without sanitisation
Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe entry input into the island response without preserving the safe-input marker, and NuxtIsland lat…
CVE-2026-114493High· 8.6LocalAI v4.6.0 through v4.11.0 SSRF Guard Bypass via HTTP Redirects
LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirect…
CVE-2026-105869Critical· 9.2Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider is intended for use with token authentication, which verifies the token before authorizat…
CVE-2026-114265Medium· 6.3PoCProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection
A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqli_query of the file returned_book_search.php of the component Search Form. Executing a manipulation of the argument da…
CVE-2026-114176Medium· 4.3WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.
CVE-2026-105926Medium· 5.3Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands
The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the schema registered for a topic, and GetOrCreateSchema, which registers a new schema version for an existing topic. The broker handled both c…
CVE-2026-112868Medium· 4.3WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a through 1.17.9.
CVE-2026-105930Medium· 6.0Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download
When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages Management Service by supplying a package URL. The Pulsar Functions worker authorized these…
CVE-2026-105927Low· 2.3Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission
The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint, including the deadLetterTopic parameter that names the topic to which messages are writt…
CVE-2026-114125High· 8.6Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and 11.0.0-alpha.6, a malicious website can interact with the preview of a running Storybook develop…
CVE-2026-113796Medium· 4.2Electron: SameSite cookie restrictions are not applied to windows opened from links
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 44.3.0, and 45.0.0-alpha.6, Electron treated pages opened into a new window from links as applicat…
CVE-2026-113797Low· 3.1Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 44.1.1, and 45.0.0-alpha.4, chrome.tabs.query() returned each tab's url and title to extensions th…
CVE-2026-20179Medium· 5.8Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities
Multiple Cisco products are affected by a vulnerability in the Snort 3 Generic Routing Encapsulation (GRE) Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting …
CVE-2026-20011Medium· 5.8Multiple Cisco Products Snort 3 SMTP MIME Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort 3 SMTP MIME Decoder that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart. This vulnerability is due to a lack of err…
CVE-2026-20291High· 7.8Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software harde…
CVE-2026-20043Critical· 9.0Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software harde…
CVE-2026-20019Medium· 5.8Multiple Cisco Products Snort 3 Netflow Denial of Service Vulnerabilities
Multiple Cisco products are affected by a vulnerability in the Snort 3 NetFlow Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet…
CVE-2026-20356High· 7.5Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software harde…
CVE-2026-113798Medium· 5.4Electron: Pointer lock permission requests can be attributed to the wrong frame
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.9, 43.7.6, 44.5.0, and 45.0.0-alpha.13, pointerLock permission requests from some cross-origin iframes caused…
CVE-2026-76462Medium· 5.5Cisco Secure Client Privilege Escalation Vulnerability
A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability …
CVE-2026-20218Medium· 5.8Cisco Secure Firewall Threat Defense Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
A vulnerability in the Snort 3 Visual Basic for Applications (VBA) Decompression Engine of multiple Cisco products could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart unexpectedly, resulting i…
CVE-2026-20197Medium· 5.8Multiple Cisco Products Snort 3 Teredo Protocol Denial of Service Vulnerability
Multiple Cisco products are affected by a vulnerability in the Snort 3 Teredo Detection Engine that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to restart, resulting in an interruption of packet …
CVE-2026-20236High· 7.5Multiple Cisco Products Snort 3 Software Hardening Release: October 2026
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software harde…
CVE-2026-20221Medium· 5.8Multiple Cisco Products Snort 3 Generic Routing Encapsulation Denial of Service Vulnerabilities
Multiple Cisco products are affected by a vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of the Snort 3 Detection Engine that could allow an unauthenticated, remote attacker to cause an unexpected r…
CVE-2026-76466Critical· 9.8PoCCisco Expressway Series Remote Code Execution Vulnerability
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root. T…