Tagged “cve.org”
CVEs tagged cve.org, newest first.
46341 CVEsRSS
CVE-2026-104135Medium· 6.5PoCOpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/payment_ajax.php validates a CSRF token but performs no AclMain authorization check before executing a …
CVE-2026-123158High· 8.1PoCsshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash)
sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurat…
CVE-2026-116782High· 7.5FreeSWITCH: Pre-authentication invalid pointer dereference in mod_rtmp connect command handling
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, rtmp_i_connect() passed the first RTM…
CVE-2026-115573High· 8.1PoCOpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/classes/Controller.class.php allows explicit controller.php dispatch to controllers missing from CONTROLLER_…
CVE-2026-103939Medium· 5.4PoCOpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, interface/modules/custom_modules/oe-module-weno/scripts/file_download.php has no ACL or CSRF check and ignores the r…
CVE-2026-87008High· 7.1PoCCode Graph RAG structural tools follow out-of-root symlinks
Code Graph RAG is an AI-powered knowledge graph and retrieval system for querying, understanding, and editing multi-language codebases. Prior to 0.0.589, AstGrepService in codebase_rag/tools/ast_grep_service.py enumerates files beneath p…
CVE-2026-102940Critical· 9.6PoCOpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.4.0, controllers/C_Document.class.php write actions, including move_action_process(), do not verify the caller's access t…
CVE-2026-123272High· 8.0mcp-go before v1.2.1 Origin Validation Error via Unvalidated Well-Known Protected Resource Metadata
Mark3labs mcp-go before v1.2.1 contains an improper validation vulnerability in OAuthHandler.fetchServerMetadata that allows malicious MCP servers to obtain tokens for other resources by declaring arbitrary resources in well-known metada…
CVE-2026-97377High· 8.8SuiteCRM: Authenticated SQL Injection in SOAP Portal Method portal_get_entry_list
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the legacy SOAP portal method portal_get_entry_list propagates caller-controlled where and order_by val…
CVE-2026-63218Medium· 6.5SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPage
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the changeReportPage controller action renders a protected report without repeating the record-level ac…
CVE-2026-123198Critical· 9.8PoCLMFDB before commit 01829bd Unauthenticated Server-Side Template Injection via /knowledge/render/<ID>
LMFDB before commit 01829bd contains a server-side template injection vulnerability in the render_knowl function that allows unauthenticated attackers to inject Jinja expressions via request parameters. Attackers can supply crafted query…
CVE-2026-100360High· 7.1SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record
SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, V8 API relationship write paths do not consistently enforce object-level edit and view authorization on…
CVE-2026-54144Medium· 6.1OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture
OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.56.0 on macOS, the runtime injected into a supported remote account webview such as Google Meet allows page JavaScript to call getDis…
CVE-2026-97174Medium· 6.8Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens
A flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation of Keycloak. The CIBA endpoint fails to properly validate the sub parameter, allowing it to be stored as an additional request parameter. During th…
CVE-2026-77463Medium· 6.5Remark42: Rate limit bypass via unconditional trust of X-Forwarded-For/X-Real-IP headers in direct-internet deployment
Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. From 1.0.0 until 1.16.2, Remark42 globally trusts True-Client-IP, X-Real-IP, and X-Forwarded-For without verifying that the …
CVE-2026-97371Medium· 5.3PoCntopng: Stack buffer overflow (write) in nDPI custom category detection allows remote code execution via crafted network packets
ntopng is a web-based network traffic monitoring application. Prior to 6.7.260721, ndpi_get_custom_category_match writes a four-byte nDPI protocol-category value through a pointer to the two-byte id variable in IpAddress::reloadBlacklist…
CVE-2026-122191Medium· 6.3PoCitsourcecode Airline Reservation System manage_booked.php sql injection
A vulnerability was determined in itsourcecode Airline Reservation System 1.0. This affects an unknown function of the file /admin/manage_booked.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may b…
CVE-2026-107123High· 7.5Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsing
A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Bec…
CVE-2026-122236Medium· 6.3PoCOpenHands Landing missing authentication
A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. Th…
CVE-2026-122190Low· 2.4PoCSourceCodester Online Food Ordering System Category Management add_category.php cross site scripting
A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file admin/add_category.php of the component Category Management. Performing a manipulation of the argument c…
CVE-2026-81190Medium· 6.9KurrentDB: Privileged access to read $all enables arbitrary file read and GET-only SSRF
KurrentDB is a database engineered for modern software applications and event-driven architectures. In version 26.1.0, a user authorized to read the $all stream can use Secondary Indexing query capabilities to read arbitrary files access…
CVE-2026-122189Medium· 6.3PoCOpenPPL ppl.nn CUDA Optimizer opt_graph.cc InitQuantization out-of-bounds
A vulnerability has been found in OpenPPL ppl.nn up to bb84dc9952809b3a5a0036858a3d9f68af1c83d5. The affected element is the function OptGraph::InitQuantization of the file src/ppl/nn/engines/cuda/optimizer/opt_graph.cc of the component …
CVE-2026-93389High· 8.2LiteSpeed Cache <= 7.9.1 - Unauthenticated Sensitive Information Disclosure (WooCommerce Store API Cart/Checkout PII + Cart-Token) via Public REST Caching
The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed…
CVE-2026-120553Medium· 6.4Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides_to_show' parameter in all versions up to, and including, 5.126.0 due to insufficient input sanitization and output esc…
CVE-2026-116617High· 8.1Motors <= 1.4.128 - Authenticated (Subscriber+) File Deletion via 'stm_dealer_logo_path' Parameter
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because `stm_save_user_extra_fields()`, hooked to `person…
CVE-2026-123018High· 8.3PoCeosphoros-ai DB-GPT CodeAction code_utils.py execute_code code injection
A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.2. This issue affects the function execute_code of the file code_utils.py of the component CodeAction. Performing a manipulation results in code injection. The attack c…
CVE-2026-122144Medium· 4.3nliautaud pico-content-editor cross-site request forgery
A security flaw has been discovered in nliautaud pico-content-editor up to 02d5ad6c820c5050c542ab9505819b5e0a0ba1af. This vulnerability affects unknown code. The manipulation results in cross-site request forgery. The attack may be perfo…
CVE-2026-104812Medium· 6.4Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'multi_media' Field Array Key in all versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated …
CVE-2026-120533Medium· 6.4Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User Profile in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This…
CVE-2026-119434Medium· 6.9Decompression bomb in ezstd:decompress_using_ddict/2 allows BEAM memory exhaustion via unbounded output buffer
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in silviucpp ezstd allows an attacker who supplies a zstd frame to ezstd:decompress_using_ddict/2 to exhaust memory and terminate the Erlang VM via a small fr…