Tagged “cve.org”
CVEs tagged cve.org, newest first.
46345 CVEsRSS
CVE-2026-115770Critical· 9.6Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/email_verification_token.go to bind an email-v…
CVE-2026-62662High· 7.7Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences
Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidc_service.go accepts the client-controlled resourc…
CVE-2026-122038High· 7.3krupalshah EmployeeRecruitmentSystem Requirement Board Update reqformprocessing.php mysql_query sql injection
A vulnerability was identified in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/reqformprocessing.php of the component Requireme…
CVE-2026-108387High· 8.5radare2: Remote code execution when loading Pebble/SMD binary
radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo->bclass. Opening or analyzing a crafted Pebble or Sega Mega D…
CVE-2026-53631Medium· 5.3GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds
GLPI is a free asset and IT management software package. From 0.83 until 10.0.27 and from 11.0.0 until 11.0.9, any authenticated user could submit a crafted request to change the visibility of knowledge base items, reminders, or RSS feed…
CVE-2026-47678High· 8.7GLPI: Blind Time based SQLI in dropdowns
GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, any authenticated user can submit crafted values to the dropdown values fetching endpoint that are incorporated into a database query. This per…
CVE-2026-54384Critical· 9.8VitaFit Cloud API Authentication Bypass via POST /front/login/sns/
VitaFit cloud API before 2026-10-30 contained an authentication bypass vulnerability that allows remote attackers to obtain a full session for a victim's account by submitting a linked Google or Facebook account identifier to the POST /f…
CVE-2026-54383Medium· 6.5VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint
VitaFit cloud API before 2026-10-30 contained an excessive data exposure vulnerability that allows any authenticated user to query the GET /front/relation/search/ endpoint and retrieve PII and health-related profile information for user …
CVE-2026-52848Critical· 9.2GLPI: MFA bypass
GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, during the login phase, an unauthenticated user could use a crafted URL to skip one-time-password verification, defeating two-factor authentication. This …
CVE-2026-57152High· 7.1GLPI: Unallowed notifications sending
GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and from 11.0.0 until 11.0.8, under certain conditions, GLPI permission logic could grant a user access to a document without confirming that the document w…
CVE-2026-54381High· 7.5VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure
VitaFit cloud API before 2026-10-30 contained a misconfigured cloud storage bucket vulnerability that allows unauthenticated attackers to list and download stored files without authentication. Attackers can enumerate the publicly accessi…
CVE-2026-54382High· 7.7VitaFit Cloud API AWS IAM Misconfiguration via Cognito S3 Access
VitaFit cloud API before 2026-10-30 contained an improper access control vulnerability in its Cognito-issued AWS role that allows authenticated attackers to perform s3:PutObject operations across the entire shared bucket instead of being…
CVE-2026-122028Medium· 4.3NST Labs Tech Nstbrowser Local Agent API info information disclosure
A vulnerability has been found in NST Labs Tech Nstbrowser 1.21.0. Affected by this vulnerability is an unknown functionality of the file /agent/info of the component Local Agent API. Such manipulation leads to information disclosure. It…
CVE-2026-54378Critical· 9.6VitaFit Cloud API Broken Access Control via S3 Token Endpoint
VitaFit cloud API before 2026-10-30 contained a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials by calling the POST /front/user/s3/token/ endpoint. Attackers can use these improp…
CVE-2026-54380Medium· 5.4VitaFit Cloud API Stored XSS via SVG File Upload
VitaFit cloud API before 2026-10-30 contained a stored cross-site scripting vulnerability that allows authenticated attackers to upload an SVG image containing malicious JavaScript to the shared storage bucket. Attackers can exploit the …
CVE-2026-54377Medium· 6.5VitaFit Cloud API IDOR via profile_id Endpoints
VitaFit cloud API before 2026-10-30 contained an insecure direct object reference vulnerability that allows authenticated attackers to access another user's data by supplying a different user_id or profile_id to endpoints such as GET /fr…
CVE-2026-54376High· 8.2VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure custom URI scheme vulnerability that allows a malicious application to intercept Fitbit login tokens by registering the same callback scheme (vitafit://vtio…
CVE-2026-122020Medium· 4.3NST Labs Tech Nstbrowser Local Agent Management Service stopAll stopAllBrowsers denial of service
A security flaw has been discovered in NST Labs Tech Nstbrowser up to 1.2.1. The affected element is the function stopAllBrowsers of the file /api/agent/browser/stopAll of the component Local Agent Management Service. Performing a manipu…
CVE-2026-54375High· 8.4VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure session management vulnerability that allows attackers to extract or intercept unencrypted m_session_id tokens stored in application backups, which remain v…
CVE-2026-54374High· 7.5VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a hardcoded credentials vulnerability that allows attackers to extract confidential third-party integration secrets by decompiling the APK. Attackers can retrieve embed…
CVE-2026-122266High· 8.7Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS
Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS Network Policy Agent before 1.3.7 (VPC CNI before 1.22.3) might allow an authenticated adjacent user to bypass NetworkPolicy ingress enforcement on co-locat…
CVE-2026-54373Low· 3.5VitaFit Android < 2.8.1.0 Cleartext Traffic via Missing Network Security Config
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains a cleartext traffic vulnerability that allows network-based attackers to intercept or modify unencrypted HTTP communications due to the absence of an Android network se…
CVE-2026-54372High· 8.8VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation
VitaFit Android application (com.vt.vitafit) before 2.8.1.0 contains an insecure TLS/SSL certificate validation vulnerability that allows network-based attackers to intercept and modify HTTPS traffic by exploiting a custom X509TrustManag…
CVE-2026-122019High· 7.36amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization
A vulnerability was identified in 6amTech 6valley 16.0. Impacted is the function existingAccountCheck of the file /api/v1/auth/existing-account-check of the component Social Login Flow. Such manipulation of the argument user_response lea…
CVE-2026-55368High· 8.1h2o: buffer overflow when using the %{error}x log directive
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was c…
CVE-2026-103002High· 8.8GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 2.2.0 until 2.2.2, cluster_apiserver_proxy forwarded an authenticated non-administrator's requests to a selected Kubernetes cluster w…
CVE-2026-121746Medium· 5.5nvm use --save and nvm install --save write through a symlinked .nvmrc, overwriting any file the user can write
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.40.0 through 0.40.8, `nvm use --save` and `nvm install --save` (or `-w`) write the resolved version to `$PWD/.nvmrc` wit…
CVE-2026-58128Medium· 6.2Alan: Health Insurance for Android 1.450.0 Path Traversal via ShareReceiverActivity
Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious application to write attacker-controlled files outside the intended directory via the exported ShareR…
CVE-2026-121749Low· 3.3nvm passes the version pattern to grep without -e, letting a .nvmrc inject grep options and read local files
Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.5.0 through 0.40.8, the requested version pattern is passed to `grep` as a bare argument, without `-e`, in `nvm_ls_remot…
CVE-2026-122016Medium· 6.3yangzongzhuan RuoYi-Vue Permission Service SysPermissionService.java SysPermissionService.getMenuPermission privileges management
A vulnerability was determined in yangzongzhuan RuoYi-Vue up to 3.9.2. This issue affects the function SysPermissionService.getMenuPermission of the file SysPermissionService.java of the component Permission Service. This manipulation of…