Tagged “cve.org”
CVEs tagged cve.org, newest first.
46469 CVEsRSS
CVE-2026-63433Medium· 6.8PoCMyTube: CSRF Protection Bypass via Arbitrary x-api-key Header Value
MyTube is a self-hosted downloader and player for several video websites. Prior to 1.10.6, shouldSkipCsrfProtection() in backend/src/middleware/csrfConfig.ts delegates to isApiKeyRequest(), which grants a CSRF exemption based only on the…
CVE-2026-121652Medium· 5.4Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering
Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated users to inject arbitrary web script or HTML via the (1) title, (2) address, or (3) place_name property in GeoJSON featu…
CVE-2026-95728High· 7.1Local Privilege Escalation in Virtual Intranet Access (VIA) Client for Linux
An arbitrary file write vulnerability exists in the Virtual Intranet Access (VIA) client. Successful exploitation could allow a local attacker with low privileges to escalate privileges on the affected system.
CVE-2026-95726High· 7.5Unauthenticated Buffer Overflow Vulnerability Leading to Denial-of-Service in HPE Networking VIA
A buffer overflow vulnerability in HPE Networking VIA could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected…
CVE-2026-120955High· 7.5MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata
The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user…
CVE-2026-95725High· 7.8Authenticated Local Command Injection Vulnerability in the VIA Client for Linux
A command injection vulnerability exists in the VIA client for Linux. Successful exploitation could allow a low-privileged local attacker to execute arbitrary commands with elevated privileges on the affected system.
CVE-2026-95722High· 8.8Local Privilege Escalation Vulnerability in the Virtual Intranet Access (VIA) Client
A local privilege escalation vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker with low privileges to execute arbitrary commands with…
CVE-2026-45146High· 7.2Chamilo LMS: Blind SQL Injection in model.ajax.php via filters[groupOp] authentificated
Chamilo LMS is an open-source learning management system. Prior to 1.11.40 and 2.0.1, an authenticated administrator can call the get_sessions action in /main/inc/ajax/model.ajax.php with _search=true and a crafted JSON filters parameter…
CVE-2026-95777Low· 3.1Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer Management Interface
A sensitive information disclosure vulnerability exists in the management interface of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged attacker to obtain certain sensitive information stored on the af…
CVE-2026-121577Medium· 6.7Unescaped header separators in whatstk build a regular expression that backtracks exponentially
Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from 0.2.0 before 0.9.0 allows a party that supplies a chat export to consume the CPU of the process that parses it for an u…
CVE-2026-95776Low· 3.1Authenticated Path Traversal Vulnerability in HPE Networking Fabric Composer API Allows for Limited File Read
An authenticated path traversal vulnerability exists in the API of HPE Networking Fabric Composer, which could be exploited by an authenticated low-privileged user if certain preconditions outside of the attacker's control are met. Succe…
CVE-2026-95775Low· 3.3Authenticated Local Information Disclosure Vulnerability in HPE Networking Fabric Composer
A local information disclosure vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to read certain files on the underlying operati…
CVE-2026-95774Low· 3.7Unauthenticated Sensitive Information Disclosure in HPE Networking Fabric Composer
A sensitive information disclosure vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information from the affected system.
CVE-2026-95773Low· 3.8Authenticated Local Denial-of-Service Vulnerability in HPE Networking Fabric Composer
A denial-of-service vulnerability has been identified in HPE Networking Fabric Composer. Successful exploitation of this vulnerability could allow a low-privileged local attacker to cause a partial denial-of-service condition affecting o…
CVE-2026-95772Medium· 4.2Authenticated Race Condition in API of HPE Networking Fabric Composer
A race condition vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to corrupt the configuration state of the affected system.
CVE-2026-95771Medium· 4.3Authenticated Information Disclosure in HPE Networking Fabric Composer API Endpoint
An authenticated information disclosure vulnerability exists in an API endpoint of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated remote attacker to obtain limited information about the affected system.
CVE-2026-95770Medium· 4.7Authenticated Local Sensitive Information Disclosure in HPE Networking Fabric Composer
A sensitive information disclosure vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low-privileged user with local access to view sensitive information, if certain preconditi…
CVE-2026-95769Medium· 5.3Unauthenticated Audit Log Spoofing in API of HPE Networking Fabric Composer
An audit log spoofing vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to falsify the client address recorded in audit records.
CVE-2026-95768Medium· 5.3Privilege Escalation Leading to Information Disclosure in HPE Networking Fabric Composer API
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated low-privileged remote attac…
CVE-2026-95766Medium· 5.3Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer
Sensitive information disclosure vulnerabilities in HPE Networking Fabric Composer could allow an authenticated attacker with low privileges to access sensitive information. Successful exploitation could allow an attacker to disclose sen…
CVE-2026-95767Medium· 5.3Unauthenticated Information Disclosure in HPE Networking Fabric Composer
An unauthenticated information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information about the affected system.
CVE-2026-95765Medium· 5.4Unauthenticated Sensitive Information Disclosure in Web-Based Management Interface of HPE Networking Fabric Composer
A sensitive information disclosure vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information.
CVE-2026-95764Medium· 5.7Unauthenticated Adjacent Improper Certificate Validation in HPE Networking Fabric Composer
An improper certificate validation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to access sensitive information.
CVE-2026-95763Medium· 5.9Unauthenticated Improper Certificate Validation allows Information Disclosure in HPE Networking Fabric Composer
An improper certificate validation vulnerability in HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access sensitive information if certain preconditions outside of the attacker's control are met. Success…
CVE-2026-95762Medium· 5.9Authenticated Insufficient Session Expiration Vulnerability in the API of HPE Networking Fabric Composer
An insufficient session expiration vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated administrative …
CVE-2026-95761Medium· 5.9Authenticated Improper Certificate Validation leads to Information Disclosure in HPE Networking Fabric Composer
An improper certificate validation vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to obtain sensitive information.
CVE-2026-95760Medium· 6.4Privilege Escalation Vulnerability in HPE Networking Fabric Composer API
A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated attacker with low privilege…
CVE-2026-95759Medium· 6.5Authenticated Audit Log Bypass in the API of HPE Networking Fabric Composer
Audit log bypass vulnerabilities exist in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker with low privileges to suppress the audit records of their activity on the affected system.
CVE-2026-95758Medium· 6.5Authenticated Authorization Bypass in the API of HPE Networking Fabric Composer
An authorization bypass vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated attacker to bypass security restrictions and modify protected resources on the affected system.
CVE-2026-95757Medium· 6.5Authentication Bypass Vulnerability in HPE Networking Fabric Composer API
A local authentication bypass vulnerability exists in an API of HPE Networking Fabric Composer. Successful exploitation could allow a local attacker with low privileges to write arbitrary files to remote servers configured on the affecte…