Tagged “cve.org”
CVEs tagged cve.org, newest first.
50134 CVEsRSS
CVE-2026-111721Medium· 5.4Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping
Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock records because GlobalGatewayFilter never enforces auth_warehouse scoping. Attackers holding the menu…
CVE-2026-89098Medium· 5.5PoCNfs-utils: nfs-utils: denial of service via assertion failure in fsidd
A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malform…
CVE-2026-109838Medium· 5.1IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.
IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.
CVE-2025-55653Medium· 5.5GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c)
GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_parse_lfrac function (utils/error.c). Processing a crafted MP4 file containing a zero-denominator fraction string causes gf_parse_lfrac() to divide by zero, …
CVE-2026-107674Medium· 5.1IBM i is Affected by a Denial of Service in Digital Certificate Manager
IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS using applications attempting to create secure network connections. A bad actor could use this to prevent a service fro…
CVE-2025-66969High· 7.5Integer overflow in OpenModSim (<=1.11.0), leading to denial of service
Integer overflow in OpenModSim (<=1.11.0), leading to denial of service
CVE-2025-55640Medium· 5.5PoCA heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
A heap buffer overflow in the stbl_AddSize function (isomedia/stbl_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
CVE-2026-111722High· 8.1PoCLingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check
LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate…
CVE-2026-111697Medium· 6.5PoCHUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters
HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderController that trusts client-supplied userId, openId and orderNumber parameters. Attackers can enumerate …
CVE-2026-111717Medium· 4.3PoCArkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check
Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other departments' skill version metadata by bypassing the can_access_skill check. Attackers holding th…
CVE-2026-111712Medium· 6.5Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route
Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected management CGI handlers by prefixing the URI with a public route. Attackers can request paths pre…
CVE-2026-85977Medium· 5.3PoCLibtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding
A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unb…
CVE-2026-111707Medium· 5.3PoC99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check
99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header …
CVE-2026-85231Medium· 6.5A flaw was found in libtirpc
A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Securi…
CVE-2026-111702High· 7.5PoCChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids
ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other users' private knowledge bases by supplying sequential ids. Attackers can enumerate ids via GET /ap…
CVE-2026-111672Medium· 4.3PoCCube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id
Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated users to view or copy other project groups' pipelines by id. Attackers can enumerate sequential pipel…
CVE-2026-111667Medium· 4.3PoCREBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks
REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-privileged users to read task comments without project membership checks. Attackers can supply the id…
CVE-2026-111793Medium· 4.3CISA KEVPoCOpenwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. This may allow an authenticated user to process and convert unintended document types if bypassing…
CVE-2026-111677Medium· 5.5PoCantiword: antiword: Denial of Service via heap out-of-bounds read (CVE-2026-111677)
A flaw was found in Antiword. An attacker could exploit this vulnerability by enticing a user to open a specially crafted Word document. Due to an incorrect bounds check when parsing list records, processing the file triggers an out-of-bou…
CVE-2026-42269High· 8.1countly-server is the server-side part of Countly, a product analytics solution
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to …
CVE-2026-85985Medium· 5.4mariadb: MariaDB: Unauthorized file access via CONNECT engine functions (CVE-2026-85985)
A flaw was found in MariaDB. Certain file-access User-Defined Functions (UDFs) within the CONNECT storage engine do not properly enforce user privileges or directory restrictions when handling file system paths. An authenticated, low-privi…
CVE-2026-85746High· 8.8mariadb: MariaDB: Out-of-bound buffer write on in `ST_AsText` of nested GeometryCollections (CVE-2026-85746)
A flaw was found in MariaDB. An authenticated remote attacker with low privileges can cause memory corruption and potentially achieve arbitrary code execution by submitting specially crafted Geographic Information System (GIS) objects. Thi…
CVE-2026-42270High· 7.5PoCcountly-server is the server-side part of Countly, a product analytics solution
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs stora…
CVE-2026-86008High· 7.2Mailu is a mail server distributed as a set of Docker images
Mailu is a mail server distributed as a set of Docker images. Prior to 8577c929b4ade04d3cd4210cf036601abd793556, a domain manager targeting an administrative account or another domain manager with greater privileges can reset passwords o…
CVE-2026-59962Medium· 6.5PoCTandoor Recipes is an application for managing recipes, planning meals, and building shopping lists
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes unvalidated sort_order and order_field strings into Django ORM order_by() calls when an authenticated user suppl…
CVE-2026-68908Medium· 5.3PoClibIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, Reporting_RCBWriteAccessHandler accepts an RptID longer than 129 bytes in the repo…
CVE-2026-59967Medium· 5.4PoCTandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport
Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, looks up BookmarkletImport by sequential primary key within the active Space without restricting created_by to the requ…
CVE-2026-49868Critical· 9.8RIOT: DHCPv6 client _parse_reply() missing sub-option length check leads to size_t underflow and unbounded OOB heap read
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation bef…
CVE-2026-48503High· 7.5PoClibIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session
libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. Prior to 1.6.2, the MMS file service in src/mms/iso_mms/server/mms_file_service.c accepts an out-o…
CVE-2026-102693Critical· 9.6RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID w…