Tagged “cve.org”
CVEs tagged cve.org, newest first.
47817 CVEsRSS
CVE-2026-82942High· 7.5Apache bRPC: Race Condition on the Shared Socket Input Buffer in the RDMA Transport Causes Remote Denial of Service
A data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA is enabled at build time and runtime. Root Cause: When a bRPC server negotiates RDMA w…
CVE-2026-87849Medium· 4.3Apache bRPC: Out-of-bounds read via non-object fields in Discovery naming-service reply parsing
The Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values without first validating that those values are objects. A malformed Discovery response whose d…
CVE-2026-90484Medium· 6.5Apache bRPC: Null pointer dereference in MySQL reply parser leading to client crash
The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A response packet whose declared payload length is zero is accepted by the frame-length check (…
CVE-2026-86249Critical· 9.1Apache bRPC: Authentication bypass when a server sets ServerOptions.internal_port and ServerOptions.auth
On a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be abused to bypass authentication entirely. VerifyHttpRequest() returns true without checking …
CVE-2026-86147High· 7.5Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof
External control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers who can reach the builtin service port to create directories and truncate/overwrite fi…
CVE-2026-114405High· 8.7Denial of Service via Malformed VATP Packet in Velneo vServer
Improper validation of array index vulnerability in Velneo vServer. This issue affects vServer: from 36.0 before 36.6 and from 37.0 before 37.2.
CVE-2026-114120Medium· 5.4SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wps…
CVE-2026-114388Medium· 5.3Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController
Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows unauthenticated users to modify gradebook certificates. Attackers can request the set_d…
CVE-2026-114387High· 8.8Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components
Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create administrators and grant permissions. Attackers can call CreateTeamMember::store() or Pe…
CVE-2026-114386Medium· 4.8Pydantic AI Harness tool-call limit bypass in nested CodeMode calls
Pydantic AI Harness tool-call limit bypass in nested CodeMode calls
CVE-2026-114390Medium· 5.3Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers
Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/ that exposes user names and certificates. Unauthenticated or low-privileged users can cal…
CVE-2026-114393Medium· 4.3PoCTrudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via PUT /api/v1/tickets/:id and PUT /api/v2/tickets/batch. Attackers can supply arbitrary tic…
CVE-2026-114391High· 7.1ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods
ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL checks for any method containing 'ajax'. Minimal-privilege users can call methods like ta…
CVE-2026-114389Medium· 4.3Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade
Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any authenticated user to obtain AI grading of other students' exam attempts. Attackers can enum…
CVE-2026-114392Medium· 5.3PoCTrudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET /api/v1/tickets/:uid. Attackers can enumerate sequential ticket uids to read every ticket'…
CVE-2026-114396High· 7.1PoCTrudesk through 1.2.11 MongoDB $where Injection via tickets search API
Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where clause via the search parameter. Attackers can close the regular expression in GET /api…
CVE-2026-114395Medium· 4.3PoCTrudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send
Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other users due to an incomplete CVE-2022-1931 fix. Attackers can supply arbitrary owner and cI…
CVE-2026-114394Medium· 4.3Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs
Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by supplying user-controlled owner IDs. Attackers can set ownerId or owner in postComment, po…
CVE-2026-114399Medium· 6.5Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file value…
CVE-2026-114398Medium· 5.4Trudesk through 1.2.11 Unrestricted File Upload via /settings/general/uploadlogo
Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public webroot via the uploadlogo, uploadpagelogo and uploadfavicon endpoints. Attackers can s…
CVE-2026-114397High· 7.4PoCTrudesk through 1.2.11 Missing Authentication on Debug Routes
Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated attackers invoke them remotely. Attackers can call /debug/populatedb to delete all groups,…
CVE-2026-114401Medium· 5.3PoCTrudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login
Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by submitting regex patterns to POST /api/v1/login. Attackers can send alternations or prefixes lik…
CVE-2026-114400Medium· 5.9PoCTrudesk through 1.2.11 Missing Authentication for Ticket Attachments via /uploads
Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments under /uploads. Because express.static serves the public/ directory before the hasAuth-gu…
CVE-2026-114402Medium· 4.3PoCTrudesk through 1.2.11 Path Traversal and Authorization Bypass via Profile Image Upload
Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied _id and username fields. Attack…
CVE-2026-114404Medium· 6.1PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation content to inject script into generated HTML. Attackers can craft a PPTX with malicious text r…
CVE-2026-114403High· 8.1PoCPHPOffice PHPPresentation through 1.2.0 Deserialization via Reader\Serialized::load
PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP containing PhpPres…
CVE-2026-19630High· 7.5Amplified resource exhaustion in inbound message processing
In a BIND resolver, inbound DNS protocol messages with a particular structure will result in additional processing, with no limit imposed by BIND. A DNS message with a maliciously large number of such structures will cause BIND to consu…
CVE-2026-114245High· 7.3PoCdhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization
A weakness has been identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this issue is some unknown functionality of the file /Admin/include…
CVE-2026-94300High· 8.1PoCConcurrent GSS-TSIG messages corrupt memory
Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries…
CVE-2026-96888High· 7.5Named may terminate unexpectedly when a redirect zone is used with strict QNAME minimization
A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect. This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9…