Tagged “cve.org”
CVEs tagged cve.org, newest first.
48134 CVEsRSS
CVE-2026-112950Medium· 5.9PoCVitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/i…
CVE-2026-93003Medium· 6.9NetX Duo Web HTTP server interprets request body content as HTTP header fields
The Web add-on's HTTP server searches the entire request packet for header fields instead of stopping at the end of the header section. A header field name placed in the request body is therefore reported to the server as though it were …
CVE-2026-90797High· 7.7Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fi…
CVE-2026-90799Low· 1.3Apache CouchDB: Atom-table exhaustion in _changes sequences and _search bookmarks with specially crafted sequence values
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes t…
CVE-2026-90798Low· 0.6Apache CouchDB: Replicator follows redirects indefinitely
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recomm…
CVE-2026-86471Critical· 9.3Apache CouchDB: Admin credentials leading to code execution as operating system user
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to versio…
CVE-2026-113594Medium· 5.4Sharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route
Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers…
CVE-2026-113359Medium· 4.3Baserow before 2.3.0 Cross-Workspace Data Disclosure via unique_row_values Endpoint
Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique_row_values API endpoint. Attackers can enumerate sequential field IDs to ret…
CVE-2026-113597Medium· 5.4Blinko through 1.8.8 IDOR via Tag tRPC Router Procedures
Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequentia…
CVE-2026-113595Medium· 4.3Sharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route
Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGE_SETTINGS permission. Attackers can remove the …
CVE-2025-71436High· 7.1PoCraptor2: raptor2: arbitrary code execution via heap-based buffer overflow in language tag handling (CVE-2025-71436)
A flaw was found in raptor2. The library improperly handles language tag lengths when parsing RDF (Resource Description Framework) documents, truncating lengths that exceed 255 bytes. A remote attacker can exploit this vulnerability by sup…
CVE-2026-113602Medium· 5.3PoCnet.minidev/json-smart: json-smart: Input validation bypass via substitute character in strict mode (CVE-2026-113602)
A flaw was found in json-smart. A remote attacker can exploit this input validation bypass vulnerability by submitting crafted JSON data containing a literal substitute (0x1A) character followed by malformed content. This causes strict-mod…
CVE-2026-113598Medium· 4.3Modoboa before 2.8.0 IDOR via API v2 alarms bulk_delete
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk_delete/ action. Attackers can enumerate sequential alarm I…
CVE-2026-113600Medium· 5.4Fat Free CRM before 0.26.0 IDOR via CommentsController update and destroy
Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsController#update and #destroy use an unscoped Comment.find w…
CVE-2026-113599Medium· 5.4Modoboa before 2.8.0 IDOR via API v2 armessages Auto-Reply Creation
Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply messages for arbitrary mailboxes by supplying another user's mbox value. Attackers can POST to /api/v2/a…
CVE-2026-113596Low· 3.1Webstudio before 0.256.0 Information Disclosure via tRPC publishedBuilds and findManyByIds
Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's projec…
CVE-2026-113604Medium· 5.5Ghidra 10.2 through 12.1.4 Denial of Service via ELF Loader Extended Header Counts
Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF …
CVE-2026-113603Medium· 6.5x402 @x402/extensions 2.3.1 through 2.28.0 SIWX Payment Bypass via PaymentPayload.resource
The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module 2.16.0 through 2.28.0 contains an authorization bypass vulnerability that allows paying clients to unlock unpaid rout…
CVE-2026-113601Medium· 4.3Memos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity
Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumer…
CVE-2026-113607Medium· 6.5Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data
Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block_configurable_reports_get_report_data web service. When check_p…
CVE-2026-113606High· 7.1PoCStirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders
Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a f…
CVE-2026-113605High· 7.2PoCStirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database
Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can up…
CVE-2026-113612Medium· 5.4PoCSparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint
SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from publ…
CVE-2026-113609Low· 3.3Bandisoft Bandizip before 7.47 Mark-of-the-Web Bypass for PowerShell Scripts
Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloade…
CVE-2026-113608Medium· 5.3Configurable Reports block for Moodle before 5.3.1 SQL Injection via filter_var
Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection vulnerability in report_sql::prepare_sql() via the filter_var request parameter of viewreport.php. Low-privileged users permi…
CVE-2026-113613High· 8.1FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ …
CVE-2026-113611Medium· 4.9PoCOutline before 1.8.0 Information Disclosure via Orphaned Webhook Subscriptions
Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins wh…
CVE-2026-113610Medium· 5.4Xen Orchestra before 6.9.0 Authorization Bypass via user.set API
Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. At…
CVE-2026-113679High· 7.0HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string
HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to_string import has a wrong WAMR signature. Attackers can supply a crafted font whose wasm module …
CVE-2026-113677Medium· 5.4PoCFroxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API
Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attacker…