Tagged “cve.org”
CVEs tagged cve.org, newest first.
50077 CVEsRSS
CVE-2026-111581Low· 3.3A flaw was found in libblockdev
A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or …
CVE-2026-77630High· 7.5libupnp: libupnp: Denial of Service via synchronous hostname resolution (CVE-2026-77630)
A flaw was found in libupnp. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by submitting requests containing slow or non-responsive hostnames. Because the library performs synchronous netwo…
CVE-2026-54657Medium· 6.5Open Zaak is an open-source data and services layer for Dutch case-oriented working
Open Zaak is an open-source data and services layer for Dutch case-oriented working. From 1.0.0 until 1.27.2, 1.28.2, and 1.29.0, the POST search endpoints /zaken/api/v1/zaken/_zoek and /documenten/api/v1/enkelvoudiginformatieobjecten/_z…
CVE-2026-109587High· 8.8Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel
Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigne…
CVE-2026-109588High· 8.8Numeric truncation in the MPU buffer authorization check in FreeRTOS-Kernel
Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enab…
CVE-2026-102551High· 7.7Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP Router Advertisement handling
Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link p…
CVE-2026-102552Medium· 5.9Improper verification of the source of a communication channel in FreeRTOS-Plus-TCP DNS resolver
Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow remote third-party to insert a chosen address into the device's DNS cache via a forged DNS reply. …
CVE-2026-109839Low· 3.1IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.
IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.
CVE-2026-111603Medium· 4.3PoCPlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints
PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access department-restricted courses by omitting the department visibility check. Attackers can enumerate se…
CVE-2026-111392Medium· 4.8PoCSGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests
SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached KV entries across requests. Attackers can send a different image under a known or predicted hash…
CVE-2026-111605High· 8.1PoCJpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController
Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access SSH hosts belonging to other workspaces by supplying foreign SSH asset ids. Attackers with SSH f…
CVE-2026-111604Low· 3.8PoCeladmin through 2.7 Broken Access Control via /api/users Update and Delete
eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts outside their data scope because write handlers skip department checks. Attackers with user:edit …
CVE-2026-111608Medium· 4.2PoCJeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other merchants' division receivers by exploiting an ownership check on the wrong column. Attackers holdin…
CVE-2026-111607High· 7.1PoCJeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInte…
Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite another merchant application's payment channel configuration by supplying a victim infoId to MchPayInte…
CVE-2026-111606High· 8.1Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC
Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons by calling the mergeSpecifiedPersons account RPC. Attackers knowing two person UUIDs can graft att…
CVE-2026-111610Medium· 5.4PoCB3log Solo through 4.4.0 Missing Authorization in ArticleConsole
B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articl…
CVE-2026-111609Low· 3.8PoCPKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription
PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers c…
CVE-2026-111612High· 7.5PoCnetdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi
netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donated netdisk credentials via the /v2/randomAuth endpoint in ParserApi. Attackers can repeatedly cal…
CVE-2026-111611Medium· 5.4roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders
roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel or continue payment on other users' orders. Attackers can supply another user's order number to …
CVE-2026-111613High· 7.5PoCAllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test en…
CVE-2026-111615Medium· 6.5PoCMall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint
Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants to read other shops' buyer shipping addresses via the multishop OrderController getOrderAddr handler. Attackers can enu…
CVE-2026-111614Medium· 6.5PoCDataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials
DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticated users to read other users' datasources, snippets and dashboards by numeric id. Low-privileged …
CVE-2026-111617Medium· 6.5PoCWHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection
WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/ and /ws/ui/actuator/ WebSocket endpoints because UiAutomationConsumer accepts every connection. A…
CVE-2026-111616Medium· 4.9Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings
Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read another co-tenant site's private settings. Attackers with the Administrators role on one site ca…
CVE-2026-111621Medium· 4.3TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}
TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw form settings via GET /user/form/setting/{key}. Attackers can supply the 8-character form key from …
CVE-2026-111619Medium· 6.5PoCFilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php
FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY clauses via the unvalidated asc parameter. Attackers can use blind boolean or time-based subqueries…
CVE-2026-111618Medium· 5.3PoCCoAI through 4.0.0 Unauthenticated Path Traversal via Archive Download Endpoints
CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoints via the hash query parameter. Attackers can supply ../ sequences in hash to download any read…
CVE-2026-111622Medium· 6.8PoCsmart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter
smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2 authorization codes by supplying an unvalidated redirectUri parameter. Attackers can send crafted…
CVE-2026-111620Medium· 5.3PoCO2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint
O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream…
CVE-2026-111624Low· 3.7Umbraco CMS before 17.7.1 and 18.2.1 Missing Authorization on SignalR Hubs
Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the backoffice PreviewHub and BackofficeHub SignalR hubs. Attackers can complete the SignalR negotiate …