Tagged “cve.org”
CVEs tagged cve.org, newest first.
46345 CVEsRSS
CVE-2026-121145High· 7.1Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web c…
CVE-2026-118391High· 8.9Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto
Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote attacker to exhaust memory in the application and in the database server by sending requests with distinct JSON keys …
CVE-2026-57853High· 8.8DataGerry < 3.3.0 SSTI via DocAPI Template Rendering
DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the template_data field via POST /rest/doca…
CVE-2026-100407Medium· 4.4PoCGit for Windows: git-credential-wincred OAuth Store Heap Overflow
Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-charac…
CVE-2026-121971High· 8.2Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References
The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or auth_basic) into a request before resolving a relative URL against the base_uri, allowing a network-path reference such…
CVE-2026-122120Critical· 9.0In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.
In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.
CVE-2025-71454Medium· 6.5PoCvtenext before 25.02.2 CSRF Protection Bypass via HTTP Method Tampering
vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csrf_token validation for non-POST requests. Attackers can induce a logged-in user to open a crafted…
CVE-2026-122148High· 8.2In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability
In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke…
CVE-2026-122006Critical· 9.8PoCThe activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attach…
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attach…
CVE-2026-59267Medium· 5.8Apache OpenOffice: Heap Buffer Overflow in DXF LWPOLYLINE import could cause memory corruption
A crafted DXF document causes a heap buffer overflow in Draw in Apache OpenOffice 4.1.16 and earlier. This could cause a crash or otherwise a corruption of memory areas. Users are recommended to upgrade to version 4.1.17, which fixes thi…
CVE-2026-80335High· 8.4Out-of-bounds Write in Bootloader
Memory Corruption when processing firmware update data in Download mode due to a missing bounds check.
CVE-2026-79405High· 7.5Improper Input Validation in Modem Firmware
Transient DOS when processing a malformed NR RRC configuration message due to improper input validation.
CVE-2026-76506High· 7.6Cisco Unified Computing System Central Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated, remote attacker to achieve remote code execution or conduct information disclosure attacks on an affected device. This v…
CVE-2026-77690High· 8.8Command injection vulnerability
ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially craf…
CVE-2026-109518High· 7.7PoCAPT RCE via hard link reuse
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick t…
CVE-2026-84730High· 8.7Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name. Refer to the ' Security Update for ASUS Router AiCloud Fe…
Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name. Refer to the ' Security Update for ASUS Router AiCloud Fe…
CVE-2026-59268High· 7.3Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader
An out-of-bounds Write vulnerability in Apache OpenOffice versions through 4.1.16 could allow an attacker to craft a Microsoft Word document that would crash the program, or otherwise corrupt other memory areas. Users are recommended to…
CVE-2026-100252High· 8.6Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID
Improper Authorization vulnerability in Apache ZooKeeper. When SASL authentication is enabled on the client port, the server's SASL callback handler grants every authorization identity (authzid) that a client requests, without checking …
CVE-2026-90629High· 7.3Apache OpenOffice: Out of bounds memory access during WMF import
An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption. Users are recommended to upgrade t…
CVE-2026-90624High· 7.3Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability
An unchecked memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 on allows a crafted PDF to execute an out-of-bounds memory write. This could crash the program or cause memory corruption. Users are recommend…
CVE-2026-59264High· 7.8Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer
The Windows installers of Apache OpenOffice 4.1.16 and earlier allow an already manipulated system to run external code with elevated access. Users are recommended to upgrade to version 4.1.17, which fixes this issue.
CVE-2026-90626High· 7.3Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files
An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade t…
CVE-2026-90628High· 7.3Apache OpenOffice: Stack overflow in CFF hint handling
An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code. Users…
CVE-2026-90634High· 7.3Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files
An uncontrolled memory access in the PDF import code of Apache OpenOffice versions through 4.1.16 allows a crafted PDF to cause an out-of-bounds memory write, causing program crash or memory corruption. Users are recommended to upgrade t…
CVE-2026-102337Medium· 4.9Webmin: SSRF exploit in Upload and Download and File Manager modules
Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-publ…
CVE-2026-122299High· 8.8Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation
Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in _parse_commit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while …
CVE-2026-77372High· 8.8VeraCrypt: Heap overflow and out-of-bounds read in Serializable deserialization (elevated Core service input path)
VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.30, the Unix, macOS, and FreeBSD serialization paths in src/Platform/Serializer.cpp and src/Volume/VolumePassword.cpp accept untrusted length and c…
CVE-2026-62365Medium· 5.3Wazuh: Heap Buffer Overflow in DecodeWinevt() join_data Accumulation via Crafted EventChannel XML
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents …
CVE-2026-97702Medium· 5.3Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce
Open edX Platform enables the authoring and delivery of online learning at any scale. From the Ulmo release until release/ulmo.4 and release/verawood.1, the GET /api/support/v1/manage_course_team/ endpoint in CourseTeamManageAPIView requ…
CVE-2026-122047High· 7.3Campcodes Complete Advance Loan Management System banner.php move_uploaded_file unrestricted upload
A security vulnerability has been detected in Campcodes Complete Advance Loan Management System 1.0. This affects the function move_uploaded_file of the file /loan/application/banner.php. Such manipulation of the argument image leads to …