Tagged “cve.org”
CVEs tagged cve.org, newest first.
50306 CVEsRSS
CVE-2026-102980Medium· 6.5PoCPlane is an open-source project management tool
Plane is an open-source project management tool. Prior to 1.4.0, PageVersionEndpoint in apps/api/plane/app/views/page/version.py scopes page-version lookups by workspace and page identifiers but not by the project_id from the URL. Projec…
CVE-2026-0321Medium· 6.6Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a data…
Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a denial of service (DoS) condition by sending specially crafted network traffic to or through a data…
CVE-2026-85714Critical· 9.1PoCStirling-PDF is a locally hosted web application that facilitates various operations on PDF files
Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api…
CVE-2026-82402Medium· 5.3PoCGogs is an open source self-hosted Git service
Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected. internal/urlx…
CVE-2026-82153Low· 2.2Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability
Dell OS Recovery Tool, versions prior to 2.4.4, contains an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with physical access could potentially exploit this vulnerability, leading to Information Disc…
CVE-2026-73261High· 7.5PoCMongoose is an embedded web server and network library
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MG_ENABLE_TCPIP in src/net_builtin.c does not reject a TCP option whose declared opts[1] length exceeds the remaining option byte…
CVE-2026-73260High· 7.5PoCMongoose is an embedded web server and network library
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails to verify that a long-form DER element length fits within the remaining certificate buffer. In mg…
CVE-2026-73252High· 7.5PoCMongoose is an embedded web server and network library
Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS stack selected by MG_TLS_BUILTIN in src/tls_builtin.c accepts a TLS 1.3 record whose decrypted size is exactly the 16-byte authentication tag with no…
CVE-2026-63626High· 8.8Mongoose is an embedded web server and network library
Mongoose is an embedded web server and network library. Prior to 7.23, ppp_handle_ipv6cp() in src/l2_ppp.c trusts the 16-bit IPv6CP len field without checking it against the received payload size. On a PPP or PPPoE link using MG_ENABLE_T…
CVE-2026-55167Medium· 4.2LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g
LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9.6, installations with WebAuthn two-factor authentication leave the challenge in the same PHP ses…
CVE-2026-54525High· 8.8Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code
Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.28, Markdown Preview Enhanced preview-link handling passes a decoded, Markdown-controlled link target to a Windows file-opening helper that in…
CVE-2026-110775Medium· 6.5PoCNexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads
Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenants' knowledge-base files by skipping tenant comparison for knowledge_base/ reads. Attackers in mu…
CVE-2026-110774Medium· 5.3PoCBlinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check
Blinko through 1.8.8 contains a broken access control vulnerability in the /api/file route that allows authenticated users to read other users' private attachments due to a flawed owner check. Attackers can supply another user's stored f…
CVE-2026-110773Medium· 4.3PoCGrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent
GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-r…
CVE-2026-110772Medium· 4.3PoCSure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions
Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read_only or no sh…
CVE-2026-110771Medium· 4.3PoCShopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field
Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers by supplying a customerId field. Attackers can send crafted requests to POST /api/v1/auth/produc…
CVE-2026-110770High· 8.1PoCDatabasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password
Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-digit code for a …
CVE-2026-110769High· 8.6PoCholaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowF…
holaOS through 2026.822.1 contains a missing authorization vulnerability in channel-gateway connectors that allows any messaging-platform user to submit agent tasks because the #isAllowed check accepts all senders when the default allowF…
CVE-2026-110768Medium· 4.8PoCholaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id
holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders by mutable username rather than only numeric id. Attackers who register a released username listed…
CVE-2026-110767High· 7.5PoCGitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs
Gitingest through 0.3.1 contains a symlink following vulnerability in ingest_query single-file blob ingestion that allows unauthenticated attackers to read server files by submitting symlink blob URLs. Attackers can commit a symlink to a…
CVE-2026-110766Medium· 4.3PoCColanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId
Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences …
CVE-2026-110765Medium· 5.9PoCFlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment…
CVE-2026-110764Medium· 5.3PoCAstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId
AstronRPA through 1.1.6 contains an insecure direct object reference vulnerability in the resource-service /file/download endpoint that allows authenticated users to download other tenants' files by supplying their fileId. Attackers can …
CVE-2026-110763Medium· 4.3PoClamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks
lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findDeptByCompany endpoint that skips URI permission checks. Authenticated low-privilege users can ite…
CVE-2026-110762Low· 3.7bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility
bbPress before 2.6.19 contains an information disclosure vulnerability that allows unauthenticated visitors to view restricted subforum posts because hide_sitewide ignores ancestor forum visibility. Topics and replies in public subforums…
CVE-2026-110761High· 8.8ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives
ILIAS before 9.24, 10.12, and 11.5 contains a PHP object injection vulnerability that allows authenticated users with Test creation or import permission to deserialize arbitrary objects via crafted Test archives. Attackers can inject a m…
CVE-2026-110667High· 7.3A security flaw has been discovered in cemtan sar2html 4.0.0
A security flaw has been discovered in cemtan sar2html 4.0.0. Affected by this vulnerability is an unknown functionality of the file sar2html.py. The manipulation of the argument SECRET_KEY results in hard-coded credentials. The attack c…
CVE-2026-110666Medium· 6.5PoCA vulnerability was identified in cemtan sar2html 4.0.0
A vulnerability was identified in cemtan sar2html 4.0.0. Affected is the function updateDb of the file sar2html.py of the component File Upload. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The…
CVE-2026-110536Critical· 10.0PoCA vulnerability was determined in D-Link DIR-868L 2.01b05
A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injectio…
CVE-2026-110248Medium· 5.3Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials f…
Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials f…