Tagged “cve.org”
CVEs tagged cve.org, newest first.
46343 CVEsRSS
CVE-2026-57567High· 8.6PoCReadest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. In affected desktop Tauri builds prior to 0.11.10, the apps/readest-app/src-tauri/src/transfer_file.rs comman…
CVE-2026-115473Medium· 6.5PoCMongoose: Heap OOB reads and null-byte bypass in mg_path_is_sane (util.c)
Mongoose is an embedded web server and network library. Prior to 7.22, mg_path_is_sane in src/util.c read path.buf[1] without first requiring path.len to be at least two and read s[2] when only two bytes remained. Unauthenticated remote …
CVE-2026-55367High· 7.5h2o: heap exhaustion using capsules
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to…
CVE-2026-86041Medium· 5.3PoCezBookkeeping: Source-IP allowlist (MCP & API token) is bypassable via a spoofed `X-Forwarded-For` header
ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New() without configuring SetTrustedProxies, causing c.ClientIP() to trust a spoofed X-F…
CVE-2026-122131Low· 3.7Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key
Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration …
CVE-2026-122130High· 8.2CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin
CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers c…
CVE-2026-122132Medium· 6.1PoCgo-chi chi 5.2.2 through 5.5.0 Open Redirect via RedirectSlashes Middleware
go-chi chi 5.2.2 through 5.5.0 contains an open redirect vulnerability in the RedirectSlashes middleware that allows attackers to redirect victims to external hosts by embedding tab characters in request paths. Attackers can craft links …
CVE-2026-122127High· 7.5CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder
CESNET ipfixcol2 2.7.1 before 2.9.0 contains a heap-based buffer overflow in Lz4Decoder.cpp that allows unauthenticated network peers to write past heap buffers. Attackers can declare a small ring buffer_size followed by a large decompre…
CVE-2026-122126Medium· 5.9reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket
reSIProcate reTurn client through 1.14.0 contains a heap buffer overflow in TurnTcpSocket::handleReadHeader(), which TurnTlsSocket inherits, that allows malicious TURN servers or on-path attackers to overwrite memory via oversized frame …
CVE-2026-102895Critical· 9.8GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_l…
CVE-2026-121969Medium· 6.5netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage
netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious …
CVE-2026-121968Medium· 6.5Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets
Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting…
CVE-2025-71457Critical· 9.8PoCvtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php
vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account password via hub/rpwd.php without token verification. Attackers knowing a valid user_name can send a…
CVE-2025-71456High· 8.1PoCvtenext before 25.02.2 SQL Injection via fieldname in Fax EditView
vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a crafted fieldname parameter to modules/Fax/EditView.php. Attackers can read arbitrary database con…
CVE-2025-71455Medium· 5.3PoCvtenext before 25.02.2 Session Identifier Disclosure via Touch Web Service
vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by the Touch web service endpoint. Attackers who can run script in the vtenext origin, such as throu…
CVE-2026-122133High· 8.8Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exe
Mistral Vibe before 2.25.5 on Windows contains an untrusted search path vulnerability that allows attackers to execute code by placing git.exe in a repository root. Attackers can lure users into opening a crafted repository so SessionLog…
CVE-2026-115474Medium· 6.5Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission
Zulip is an open-source team collaboration tool. From 8.0 until 12.2, in organizations where the Who can view all other users in the organization setting restricted guests from viewing other users, saving or editing a direct message draf…
CVE-2026-63183Medium· 6.9OmniAuth: Host Header Injection Vulnerability
OmniAuth is a flexible authentication system utilizing Rack middleware. Prior to 2.2.0, OmniAuth derives provider callback URLs from request-controlled host information when neither a fixed full_host nor framework-level incoming host val…
CVE-2026-115574Medium· 5.3PoCZulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels
Zulip is an open-source team collaboration tool. From 11.0 until 12.2, organizations with web-public channels enabled exposed the GET /json/users endpoint to logged-out spectators, and a missing access-control check allowed include_custo…
CVE-2026-97705High· 7.5Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser
Moleculer is a progressive microservices framework for Node.js. Prior to 0.14.36 and 0.15.2, Parser._write in src/transporters/tcp/parser.js used Buffer.prototype.readInt32BE to read a signed packet length, so a remote unauthenticated pe…
CVE-2026-122220High· 7.4WPO365 LOGIN before 45.2 SAML Replay Protection Bypass
WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay vulnerability caused by a non-functional anti-replay check in Saml2_Service::check_message_id(), which never persists processed …
CVE-2025-71453Medium· 6.1vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList
vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitized widgetId keys from the widgetInfoList JSON parameter. Attackers can induce a logged-in user to…
CVE-2026-120422High· 8.9Insecure HTTP configuration retrieval in Sogou Input Method allows arbitrary code execution
Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of…
CVE-2026-113780Critical· 9.3ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. From 5.5.5 until 5.5.6, 6.0.4, and 6.1.1, the esp_tee trap entry in esp_tee_vectors_plic.S and esp_tee_vectors_clic.S saves a caller-controlled register frame throu…
CVE-2026-82029Medium· 6.5Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portal
Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal contacts to access documents belonging to other vendors and clients by exploiting authorization checks that validate only…
CVE-2026-118513High· 7.7Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)
Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to 5.4.56, 6.x prior to 6.4.50, 7.x prior to 7.4.23, and 8.x prior to 8.1.11 allows an attacker holding a certificate from th…
CVE-2026-100235Medium· 6.0Apache ZooKeeper: ACL enforcement bypass allows unauthorized operations to commit after an ACL revocation
Incorrect authorization due to a time-of-check to time-of-use (TOCTOU) race condition in the setACL request handling of Apache ZooKeeper. When a node's ACL is changed via setACL, the pending change is not published to the server's outst…
CVE-2026-121147High· 8.5Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker p…
CVE-2026-121144High· 8.8Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account credentials, API Keys and authorization tokens within the application package. An unauthenticated remote attacker could …
CVE-2026-121146Medium· 6.8Information Disclosure Vulnerability in Tata Motors iRA and iRA.ev mobile application
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens in application logs used for development and debugging. A local attacker with an access to logs could exploit this vuln…